Threat · curated 16 Sep 2026
Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories
First reported thehackernews.com
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
The Shai-Hulud incident shows attackers weaponizing hijacked AI coding-assistant sessions to inject poisoned dependencies and propagate a self-spreading worm through internal repositories, a concrete supply-chain risk for teams relying on AI dev tools.
Mandiant reports an attacker hijacked an active AI coding-assistant session at an unnamed SaaS provider, prompting the assistant to recommend a poisoned package that a developer accepted, then used the session to install an infostealer via a poisoned PyPI package and spread the Shai-Hulud worm across roughly 100 internal repositories. The worm stole repository secrets and product source code. The case appears in Mandiant's September 2026 AI risk report; the report does not detail how the session was taken over.
Summary
Mandiant documented an intrusion in which an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider. The assistant recommended attacker-poisoned software, the developer accepted it, and the attacker then used the live session to deploy the self-spreading Shai-Hulud worm across roughly 100 internal code repositories, stealing repository secrets and product source code.[0]
The attack combined AI-assistant abuse with classic supply-chain poisoning: an infostealer was installed via a poisoned PyPI package, GitHub OAuth tokens were stolen, and a package in the company's own official namespace was poisoned so that a second employee's pull produced a follow-on infection. The public case study withholds the intrusion date and the exact session-takeover mechanism.[0]
Mandiant frames the case within a broader 2025-2026 trend of attackers moving from using generative AI for productivity to embedding large language models in malware and active operations. Separate Shai-Hulud-family campaigns targeting developer tooling and credentials were noted but not linked to this intrusion.[0]
Attack chain
- Initial access via session hijack: An attacker took control of a developer's active AI coding-assistant session at an unnamed SaaS provider; the public case study does not explain how the session was taken over.[0]
- Poisoned dependency recommendation: The AI assistant recommended software the attacker had poisoned, and the developer accepted the recommendation.[0]
- Infostealer installation and token theft: Using the developer's active session, the attacker installed an infostealer through a poisoned PyPI package and stole GitHub OAuth tokens.[0]
- Worm propagation: The attacker deployed the self-spreading Shai-Hulud worm across approximately 100 internal code repositories, stealing repository secrets and source code.[0]
- Secondary infection via namespace poisoning: The attacker poisoned a package in the company's official namespace; another employee pulled the compromised version, causing a second infection.[0]
Disclosure timeline
| Date | Event |
|---|---|
| March 2026 | Mandiant report notes attackers shifted during 2025 from using generative AI mainly for productivity to embedding large language models in malware and active attacks.[0][10] |
| September 2026 | Mandiant's AI risk and resilience report includes the case study of the hijacked AI coding-assistant session and Shai-Hulud spread.[0][8] |
| Sep 16, 2026 | The Hacker News publishes its account of the Mandiant case study.[0] |
How it works
The intrusion abused the trust placed in AI coding-assistant output: the assistant recommended attacker-poisoned software, and acceptance of that recommendation gave the attacker a foothold to install a PyPI-delivered infostealer within the developer's active session.[0]
Propagation relied on the self-spreading Shai-Hulud worm, which moved across roughly 100 internal repositories, harvesting repository secrets and source code, while stolen GitHub OAuth tokens and poisoning of the company's own official package namespace enabled continued access and a second infection when another employee pulled the compromised package.[0]
Key takeaways
- Hijacking an active AI coding-assistant session lets an attacker turn trusted assistant recommendations into a malware-delivery and supply-chain foothold.[0]
- Self-spreading worms like Shai-Hulud can rapidly scale from a single poisoned dependency to about 100 internal repositories, exfiltrating secrets and source code, with namespace poisoning enabling follow-on infections.[0]
- The case reflects a broader shift, documented by Mandiant, toward attackers embedding AI in active operations rather than only using it to speed up work.[0]
Defensive actions
- Validate AI-recommended third-party dependencies against cryptographic checksums and approved allowlists before installation.: The intrusion began when a developer accepted an AI assistant's recommendation of attacker-poisoned software, so verifying recommended packages breaks the entry point.[0]
- Keep raw API keys, long-lived OAuth tokens, and other secrets out of the direct reach of extensions and assistant sessions.: The attacker stole GitHub OAuth tokens through the active session; limiting secret exposure reduces the impact of a hijacked session.[0]
- Route dependency traffic through controlled internal repositories.: Channeling installs through vetted internal mirrors reduces exposure to poisoned public packages such as the PyPI infostealer used here and namespace-poisoned packages.[0]