Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100 internal code repositories.
Before the repository spread, the assistant recommended software that the attacker had poisoned, and the recommendation was accepted. The worm stole repository secrets and source code for the company’s products.
The case appears in Mandiant’s September 2026 report. The public case study does not say when the intrusion happened or how the attacker took over the active coding-assistant session.
How the Attack Unfolded
After the recommendation was accepted, the attacker used the developer’s active session to install an infostealer through a poisoned PyPI package. The attacker also stole GitHub OAuth tokens.
The attacker then deployed the self-spreading Shai-Hulud worm across approximately 100 internal code repositories.
The attacker also poisoned a package in the company’s official namespace. Another employee pulled the compromised version, causing a second infection.
Mandiant had already documented attackers using AI in real attacks. In a March 2026 report, it said attackers had moved during 2025 from using generative AI mainly to speed up work to using large language models in malware and active attacks.
How Defenders Can Protect AI-Assisted Development
For this case, Mandiant recommends three controls for AI-assisted development:
- Check AI-recommended third-party dependencies against cryptographic checksums and approved allowlists.
- Keep raw API keys, long-lived OAuth tokens, and other secrets out of direct reach of extensions.
- Route dependency traffic through controlled internal repositories.
Recent Shai-Hulud-family attacks have also targeted developer tools and credentials. In August, a Keyv-linked npm worm poisoned hundreds of packages and planted hooks for Claude Code and Visual Studio Code, while a later analysis found a Shai-Hulud variant scanning 469 locations for credentials across developer systems, CI/CD tools, cloud configurations, and AI tool files.
These were separate campaigns, and the available evidence does not link them to the unnamed Mandiant intrusion.
