{"id":2896,"date":"2026-09-16T14:27:54","date_gmt":"2026-09-16T14:27:54","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2896"},"modified":"2026-09-16T14:27:54","modified_gmt":"2026-09-16T14:27:54","slug":"attacker-hijacks-ai-coding-assistant-session-spreads-shai-hulud-across-about-100-repositories","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2896","title":{"rendered":"Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Sep 16, 2026<\/span><\/span>Artificial Intelligence \/ Software Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100 internal code repositories.<\/p>\n

Before the repository spread, the assistant recommended software that the attacker had poisoned, and the recommendation was accepted. The worm stole repository secrets and source code for the company’s products.<\/p>\n

The case appears in Mandiant’s September 2026 report<\/a>. The public case study does not say when the intrusion happened or how the attacker took over the active coding-assistant session.<\/p>\n

How the Attack Unfolded<\/h3>\n

After the recommendation was accepted, the attacker used the developer’s active session to install an infostealer through a poisoned PyPI package. The attacker also stole GitHub OAuth tokens.<\/p>\n

The attacker then deployed the self-spreading Shai-Hulud worm across approximately 100 internal code repositories.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The attacker also poisoned a package in the company’s official namespace. Another employee pulled the compromised version, causing a second infection.<\/p>\n

Mandiant had already documented attackers using AI in real attacks. In a March 2026 report<\/a>, it said attackers had moved during 2025 from using generative AI mainly to speed up work to using large language models in malware and active attacks.<\/p>\n

How Defenders Can Protect AI-Assisted Development<\/h3>\n

For this case, Mandiant recommends three controls for AI-assisted development:<\/p>\n

    \n
  • Check AI-recommended third-party dependencies against cryptographic checksums and approved allowlists.<\/li>\n
  • Keep raw API keys, long-lived OAuth tokens, and other secrets out of direct reach of extensions.<\/li>\n
  • Route dependency traffic through controlled internal repositories.<\/li>\n<\/ul>\n

    Recent Shai-Hulud-family attacks have also targeted developer tools and credentials. In August, a Keyv-linked npm worm poisoned hundreds of packages and planted hooks for Claude Code and Visual Studio Code, while a later analysis found a Shai-Hulud variant scanning 469 locations for credentials across developer systems, CI\/CD tools, cloud configurations, and AI tool files.<\/p>\n

    These were separate campaigns, and the available evidence does not link them to the unnamed Mandiant intrusion.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    \ue804Swati Khandelwal\ue802Sep 16, 2026Artificial Intelligence \/ Software Security Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100…<\/p>\n","protected":false},"author":1,"featured_media":2897,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[3427,1887,2025,774,1738,1161,1619,666],"class_list":["post-2896","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-assistant","tag-attacker","tag-coding","tag-hijacks","tag-repositories","tag-session","tag-shaihulud","tag-spreads"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2896","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2896"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2896\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2897"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2896"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2896"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2896"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}