An attacker managed to compromise an active session of an AI coding assistant at an undisclosed software-as-a-service provider. This breach allowed the attacker to spread a malicious worm known as Shai-Hulud across roughly 100 internal code repositories. The incident involved a poisoned software recommendation, which was accepted by the coding assistant, resulting in the theft of repository secrets and sensitive source code.

The details of this breach are highlighted in Mandiant's September 2026 report. However, the report does not specify the exact date of the intrusion or the method used by the attacker to hijack the coding assistant session. Once the compromised recommendation was accepted, the attacker leveraged the active session to deploy an infostealer via a tainted PyPI package and also managed to steal GitHub OAuth tokens.

The Shai-Hulud worm was then unleashed, affecting about 100 internal repositories. Additionally, the attacker contaminated a package in the company's official namespace. This led to a secondary infection when another employee downloaded the compromised package.

Mandiant's previous reports have noted a trend where attackers are increasingly utilizing AI in their operations. The transition from using AI for efficiency to actively incorporating it into attacks, such as employing language models in malware, has been documented since 2025. In this particular case, Mandiant suggests implementing three specific controls to safeguard AI-assisted development environments.

Notably, other attacks involving the Shai-Hulud family have targeted developer tools and credentials. In a related incident in August, an npm worm associated with Keyv compromised numerous packages and integrated hooks into popular coding tools. Although these campaigns are separate, they underscore the growing threat landscape developers face today.