AI Coding Assistant Hijack Spreads Shai-Hulud to 100 Repos

Mandiant has published details of an attack in which an intruder took over an active AI coding assistant session at an unnamed software-as-a-service provider and later spread a self-spreading worm called Shai-Hulud across roughly 100 internal code repositories. A code repository is a storage location where developers keep and manage a project's source code. Before the worm spread, the coding assistant had recommended software that the attacker had previously poisoned, and a developer accepted that recommendation. According to Mandiant, the worm then stole repository secrets and source code for the company's products.

The public case study, included in Mandiant's September 2026 report, does not state when the intrusion occurred or how the attacker first took control of the active coding assistant session. However, it describes the chain of events after the malicious recommendation was accepted. The attacker used the already active developer session to install an infostealer, a type of malware that collects sensitive data such as login details, through a poisoned package on PyPI, the Python Package Index where developers download open-source Python software. The attacker also stole GitHub OAuth tokens, which are long-lived access credentials that let applications act on a GitHub account without asking for a password every time.

With those stolen credentials, the attacker deployed the Shai-Hulud worm across approximately 100 internal code repositories. The worm is described as self-spreading, meaning it moves from one repository to another on its own once it has access. In addition, the attacker poisoned a package in the company's official package namespace, the naming area the organization controls for its own software releases. When another employee pulled the compromised version, that action caused a second infection.

The incident fits a broader pattern Mandiant has been documenting. In a March 2026 report, Mandiant said attackers had moved during 2025 from using generative AI mainly to speed up routine work to using large language models directly in malware and active attacks. This newest case is one concrete example: the AI coding assistant itself became the path through which a poisoned recommendation entered a development environment. An AI coding assistant is a tool that suggests code snippets, libraries, and fixes to developers as they work, often by reading the surrounding code and offering completions or package suggestions.

To help defenders, Mandiant lists three controls for AI-assisted development. First, check every AI-recommended third-party dependency against a cryptographic checksum, which is a unique digital fingerprint for a file, and against an approved allowlist of trusted packages. Second, keep raw API keys, long-lived OAuth tokens, and other secrets out of the direct reach of extensions, because extensions and coding tools can read files that contain those credentials. Third, route all dependency traffic through controlled internal repositories instead of letting each developer download packages directly from public sources. These steps reduce the chance that a poisoned package from a public registry will be accepted without review.

The Shai-Hulud family has also appeared in other recent campaigns that targeted developer tools and credentials, though Mandiant says the available evidence does not link them to this unnamed intrusion. In August, a Keyv-linked npm worm poisoned hundreds of packages and planted hooks for Claude Code and Visual Studio Code. npm is the main package registry for JavaScript, and a hook is a small piece of code that runs when a developer opens or uses a tool. A later analysis found a Shai-Hulud variant that scanned 469 locations for credentials across developer systems, CI/CD tools, cloud configurations, and AI tool files. CI/CD stands for continuous integration and continuous delivery, the automated pipeline that builds, tests, and releases software. Those campaigns were separate, and the source does not connect them to the Mandiant case.

For website owners, business teams, and IT staff, the case is a warning about the software supply chain. Even a single accepted package recommendation from a coding assistant can expose repository secrets, source code, and long-lived access tokens that later allow a worm to move through internal systems. The recommended controls are practical: verify what an AI tool suggests before accepting it, keep credentials out of files that tools can read, and centralize package downloads. For teams that need help reviewing those access and dependency paths, AEU-I offers security-first IT, infrastructure and consulting services that can help assess and harden the same controls described in this report.