AI assistant session hijacked: the Shai-Hulud worm spread across a hundred repositories

Mandiant has described an incident in which an attacker hijacked an active session of an AI coding assistant at an unnamed SaaS provider and ultimately spread the Shai-Hulud worm across roughly a hundred internal repositories. The case was included in Mandiant's report for September 2026; the public write-up does not say exactly when the intrusion took place or how the attacker gained control of the assistant's active session.

How the attack unfolded

The starting point was a recommendation from the assistant itself. It advised the developer to use third-party software that the attacker had poisoned in advance, and the advice was accepted. Making use of the developer's active session, the attacker installed an infostealer through a compromised package from PyPI and stole GitHub OAuth tokens.

Then Shai-Hulud itself came into play — a self-propagating worm that spread across roughly a hundred internal repositories, stealing secrets and the source code of the company's products. On top of that, the attacker poisoned a package in the organization's own official namespace: another employee pulled in the infected version, which caused a repeat infection.

Mandiant notes that such use of AI in real attacks has been observed before. In its March 2026 report, the company noted that over the course of 2025 attackers moved from using generative AI mainly to speed up routine work toward embedding large language models directly into malware and active operations.

What defenders are advised to do

With reference to this case, Mandiant recommends three measures for AI-assisted development: verify the third-party dependencies recommended by an assistant against cryptographic checksums and approved allowlists; keep raw API keys, long-lived OAuth tokens and other secrets out of the direct reach of extensions; and route dependency traffic through controlled internal repositories.

The Shai-Hulud family has increasingly been targeting developers' tools and credentials of late. In August, a Keyv-related worm for npm poisoned hundreds of packages and planted hooks for Claude Code and Visual Studio Code, while later analysis uncovered a Shai-Hulud variant that scanned 469 locations in search of credentials — on developer systems, in CI/CD tools, cloud configurations and AI-tool files. These were separate campaigns, and the available data does not link them to the intrusion described by Mandiant.

Source: The Hacker News