Mandiant Details AI Coding Session Hijack and Shai-Hulud Spread
Mandiant has described an intrusion in which an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider, then spread the self-propagating Shai-Hulud worm across approximately 100 internal code repositories. The attack stole repository secrets and source code for the company’s products.
The case study appears in Mandiant’s September 2026 report. Mandiant did not disclose when the intrusion occurred or how the attacker obtained control of the active coding-assistant session, leaving those initial-access details unresolved in the public account.
A poisoned recommendation became the entry point
Before the repository-wide spread, the coding assistant recommended software that the attacker had poisoned, and a developer accepted that recommendation. The attacker then used the developer’s active session to install an infostealer through a malicious PyPI package.
The intruder also obtained GitHub OAuth tokens. With those tokens and the compromised development context, the attacker deployed Shai-Hulud across roughly 100 internal repositories. The incident illustrates that a recommendation delivered within an AI-assisted workflow can become part of a software supply-chain attack when dependency validation is absent or ineffective.
Package poisoning extended the compromise
The attacker poisoned a package in the company’s official namespace as well. A second employee later pulled the compromised version, resulting in another infection. Mandiant’s account therefore describes both an initial compromise through an accepted recommendation and subsequent propagation through a trusted-looking internal software distribution path.
Mandiant had already reported a broader shift in attacker use of AI. Its March 2026 report said that, during 2025, attackers moved from primarily using generative AI to accelerate tasks toward using large language models in malware and active operations.
Controls for AI-assisted development
For AI-assisted development, Mandiant recommends checking third-party dependencies proposed by assistants against cryptographic checksums and approved allowlists. It also advises keeping raw API keys, long-lived OAuth tokens and other secrets beyond the direct reach of extensions.
Dependency traffic should be routed through controlled internal repositories, Mandiant said. Recent Shai-Hulud-family activity has also targeted developer tooling and credentials: an August Keyv-linked npm worm poisoned hundreds of packages and planted hooks for Claude Code and Visual Studio Code, while a later analysis identified a variant scanning 469 locations for credentials in developer systems, CI/CD tooling, cloud configurations and AI-tool files. Mandiant said those were separate campaigns, with no available evidence linking them to this intrusion.
For businesses, the practical implication is to treat AI-suggested packages as third-party code requiring the same verification, credential isolation and controlled distribution rules as every other dependency in the build process.