AI Coding Assistant Hijack Spreads Shai-Hulud Worm Across Repositories

An attacker hijacked an active AI coding assistant session at an unnamed software-as-a-service (SaaS) provider to deploy the Shai-Hulud worm across approximately 100 internal code repositories.

Mandiant reported that the breach began when the AI assistant recommended poisoned software, which was subsequently accepted by a developer. The attacker then leveraged the active session to install an infostealer via a poisoned Python Package Index (PyPI) package and stole GitHub OAuth tokens.

The intrusion resulted in the theft of repository secrets and source code for the company’s products. After the initial compromise, the attacker deployed the self-spreading Shai-Hulud worm across roughly 100 internal repositories. The attacker also poisoned a package within the company’s official namespace, leading to a second infection when another employee pulled the compromised version.

Evolution of AI-Driven Attacks

The incident highlights a shift in threat actor tactics. Mandiant noted that throughout 2025, attackers moved from using generative AI primarily to increase productivity to using large language models (LLMs) as active components in malware and attacks.

The Shai-Hulud malware family has been involved in several recent campaigns. In August, a Keyv-linked npm worm poisoned hundreds of packages and planted hooks for developer tools, including Claude Code and Visual Studio Code. A separate Shai-Hulud variant was also found scanning 469 locations for credentials across CI/CD tools, cloud configurations, and AI tool files.

Mitigating Risks in AI-Assisted Development

To defend against similar supply chain and session hijacking risks, Mandiant recommends three key controls for organisations using AI-assisted development:

• Verify dependencies: Check all AI-recommended third-party dependencies against cryptographic checksums and approved allowlists.
• Isolate secrets: Keep raw API keys, long-lived OAuth tokens, and other sensitive secrets out of the direct reach of AI extensions.
• Control traffic: Route all dependency traffic through controlled internal repositories to prevent direct pulls from public registries.