Full Report
Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100 internal code repositories. Before the repository spread, the assistant recommended software that the attacker had poisoned, and the recommendation was accepted. The worm stole repository secrets and source code for the
Analysis Summary
# Incident Report: Shai-Hulud Worm Spread via AI Coding Assistant Hijack
## Executive Summary
An attacker hijacked an active AI coding-assistant session at a SaaS provider to recommend a poisoned PyPI package, which was subsequently accepted by a developer. This facilitated the deployment of the "Shai-Hulud" worm, which successfully spread across approximately 100 internal repositories to exfiltrate source code and secrets. The incident highlights a significant shift in threat actor tactics toward exploiting generative AI tools and automated developer workflows.
## Incident Details
- **Discovery Date:** Not disclosed (Reported by Mandiant September 16, 2026)
- **Incident Date:** Circa 2025–2026
- **Affected Organization:** Unnamed Software-as-a-Service (SaaS) provider
- **Sector:** Technology / SaaS
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** Not disclosed
- **Vector:** Session Hijacking / AI Prompt Manipulation
- **Details:** The attacker took control of an active AI coding-assistant session. While the specific hijack mechanism was not detailed, the attacker manipulated the assistant to recommend a poisoned third-party dependency.
### Lateral Movement
- **Mechanism:** Self-spreading worm (Shai-Hulud) and Internal Supply Chain Poisoning.
- **Details:** After the developer accepted the AI's recommendation, the attacker stole GitHub OAuth tokens. They then deployed the Shai-Hulud worm across ~100 internal repositories. Additionally, the attacker poisoned a package within the company's official internal namespace.
### Data Exfiltration/Impact
- **Details:** The Shai-Hulud worm successfully stole repository secrets (API keys, tokens) and proprietary source code for the company's products.
### Detection & Response
- **Discovery:** Detection occurred after a second employee was infected by pulling the poisoned internal package.
- **Response:** Mandiant was engaged to document and analyze the intrusion; specific remediation steps were not publically detailed beyond the recommendation of new AI security controls.
## Attack Methodology
- **Initial Access:** Session Hijacking of an AI coding assistant.
- **Persistence:** Use of stolen GitHub OAuth tokens to maintain access to the codebase.
- **Privilege Escalation:** Not specified, though the acquisition of OAuth tokens granted broad repository access.
- **Defense Evasion:** Use of a "poisoned" recommendation within a trusted AI tool to bypass standard code review scrutiny.
- **Credential Access:** Theft of GitHub OAuth tokens and repository secrets.
- **Discovery:** Scanning for credentials in 469 locations (based on Shai-Hulud variant behavior).
- **Lateral Movement:** Self-propagating worm spreading across 100+ repositories and poisoning internal namespaces.
- **Collection:** Automated gathering of source code and environment secrets.
- **Exfiltration:** Transfer of stolen code and secrets to attacker-controlled infrastructure.
- **Impact:** Compromise of intellectual property and internal supply chain integrity.
## Impact Assessment
- **Financial:** Not disclosed; likely high due to intellectual property theft.
- **Data Breach:** Source code for products and internal repository secrets stolen.
- **Operational:** Disruption to development workflows and corruption of approximately 100 code repositories.
- **Reputational:** High risk, given the SaaS provider’s role in the supply chain for their own customers.
## Indicators of Compromise
- **Network indicators:** Traffic to malicious PyPI mirrors or unauthorized exfiltration endpoints (specific IPs/URLs not provided).
- **File indicators:** Poisoned PyPI packages; presence of the Shai-Hulud worm binary/script in repositories.
- **Behavioral indicators:** AI assistants recommending unverified third-party packages; unexpected GitHub OAuth token usage from new locations; automated commits/modifications across numerous internal repositories.
## Response Actions
- **Containment:** Isolation of the infected developer workstation and compromised internal repositories.
- **Eradication:** Removal of the Shai-Hulud worm and deletion of poisoned packages from the internal namespace.
- **Recovery:** Revocation and rotation of all compromised GitHub OAuth tokens and repository secrets.
## Lessons Learned
- **AI as a Vector:** AI assistants can be manipulated to suggest malicious code, which developers may trust implicitly.
- **Token Security:** Long-lived OAuth tokens are high-value targets that facilitate rapid lateral movement.
- **Internal Trust:** Internal package namespaces are vulnerable to "dependency confusion" or poisoning once an initial foothold is gained.
## Recommendations
- **AI Governance:** Implement mandatory checks of AI-recommended dependencies against cryptographic checksums and approved allowlists.
- **Secret Management:** Move raw API keys and long-lived OAuth tokens out of the reach of IDE extensions and AI tools.
- **Controlled Egress:** Route all dependency traffic through internal, proxied repositories that perform automated security scanning.
- **Session Protection:** Enforce stricter session timeouts and hardware-backed MFA for developer tools and AI assistant sessions.