Hijacked AI Coding Session Spreads Shai-Hulud to 100 Repos

Hijacked AI Coding Session Spreads Shai-Hulud to 100 Repos

Mandiant's September 2026 AI Risk and Resilience Report contains a case study every developer using an AI coding assistant needs to read: an attacker compromised a software-as-a-service (SaaS) provider, hijacked an active AI coding assistant session on a developer's workstation, and turned that assistant into the delivery mechanism for an infostealer and the self-propagating Shai-Hulud worm — which then spread across roughly 100 internal code repositories.

The public case study, summarized by The Hacker News, does not say when the intrusion happened or exactly how the session was taken over. What it does document is a kill chain that shows how thin the boundary around AI-assisted development really is.

The kill chain: one accepted recommendation

According to the Mandiant report, the AI assistant — operating as a "trusted interpreter" inside the environment — recommended installing an external software package that the attacker had poisoned. That recommendation was accepted. Once it was, the attacker used the developer's still-active session to:

1. Install an infostealer through the poisoned PyPI package.
2. Harvest GitHub OAuth tokens from the compromised context.
3. Deploy the self-propagating Shai-Hulud worm across approximately 100 internal code repositories.

The worm then automated the theft of repository secrets and the programmatic exfiltration of proprietary product source code. As a closing move, the attacker poisoned a package inside the company's own official namespace — another employee later pulled the compromised version and triggered a secondary, downstream infection.

Notice what did not happen: the attacker did not need to run a single phishing email on the developer, did not need SSH access, and did not need to guess at which repositories mattered. The developer's own tooling did the reconnaissance.

What the assistant actually was

This case is a textbook confused deputy — the AI coding assistant holds the trust, the credentials, and the network access of the developer, but it is making decisions about untrusted third-party code. For the attacker, an accepted AI recommendation is not different from an accepted join request: once the assistant pulls in a poisoned dependency, everything hooked to the session — OAuth token caches, CI credentials, internal registries — is now reachable.

It is also worth being precise about what Mandiant is NOT claiming: the report does not say the AI was "manipulated by prompt injection" in this case. The worm later evolved into variants that did use prompt injection (more below). Here, the describing is simpler and more alarming — the assistant recommended poisoned software, a human accepted, and the session did the rest.

Shai-Hulud was already aimed at AI tooling

Shai-Hulud is not a new name. The worm family first surfaced in September 2025 in the npm ecosystem, when roughly 40 npm packages were compromised in a supply-chain attack. By 2026, Cloud Security Alliance research tracked multiple campaigns across npm and PyPI — including a February 2026 wave ("SANDWORM_MODE") deploying fake MCP servers whose tool descriptions carried embedded prompt-injection blocks aimed directly at AI coding assistants, telling them to read SSH keys, cloud credentials, and TOKEN/KEY/SECRET environment variables and pass them into tool calls without telling the user. The same family later compromised the official @bitwarden/cli package, targeting ~/.claude.json and ~/.claude/mcp.json.

Separately — and Mandiant/THN stress these were separate campaigns not linked to this case — a Keyv-linked npm worm in August 2026 poisoned hundreds of packages and planted hooks for Claude Code and VS Code, and a Shai-Hulud variant in September 2026 was found scanning 469 locations across developer systems, CI/CD tools, cloud configurations and AI tool files for credentials.

The pattern across all of them: the attack surface is the same machine that runs your AI tooling and holds your deploy credentials. One boundary breach in that loop is all the worm needs.

Three controls Mandiant wants

The report's defensive guidance for AI-assisted development is short and actionable:

1. Validate AI-recommended third-party dependencies against cryptographic checksums and approved allowlists — via IDE and CLI verification hooks.
2. Keep raw API keys, long-lived OAuth tokens and secrets out of reach of extensions and assistants that run with the developer's session.
3. Route dependency traffic through controlled internal repositories (Mandiant names artifact registries like Google Cloud Artifact Registry) instead of letting every assistant pull directly from the public index.

A concrete version of control #1, in your requirements.txt/lockfile workflow:

# Treat an AI-recommended dependency like any other untrusted input:

# 1) install only with hash verification (pip/uv refuse on mismatch)
pip install --require-hashes -r requirements.txt

# 2) or verify a single artifact you already downloaded
curl -fsSL https://files.pythonhosted.org/packages/..../demo-1.2.3.tar.gz -o demo.tgz
echo "expected-sha256-here  demo.tgz" | sha256sum -c -

And consider it a live threat, not a theoretical one. Mandiant's March 2026 report found attackers were moving from using generative AI to speed up work to using LLMs in malware and active attacks during 2025 — the Shai-Hulud hijack is the "AI as the delivery vehicle" end of that spectrum.

The dev's takeaway

If you accept a package because "the AI recommended it", you just gave the assistant authority you would not give a random Stack Overflow answer — yet a poisoned dependency is a poisoned dependency either way. The controls that worked before AI are the controls that work now: lockfiles with hashes, allowlists, internal mirrors, pinning, and treat every agent-visible secret as one incident away from the registry you build from.

This joins a widening pattern we have been tracking: China's industrial-scale distillation campaigns and the in-the-wild Artifactory backdoor chains are examples of the same lesson — the supplies developers trust most are the softest target. And for the assistant side, MCP tool poisoning shows how a malicious tool definition reaches the model, while the higher-level picture lives in the AI agent security pillar.

Your AI coding assistant is not a security boundary. It is the most privileged extension you have ever run.

Sources

• Mandiant: AI Risk and Resilience Report 2026
• The Hacker News: Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories
• Cloud Security Alliance: Shai-Hulud — npm Worm Targeting AI Developer Toolchains
• The Hacker News: 40 npm Packages Compromised in Supply-Chain Attack