Hijacked AI coding assistant helped spread Shai-Hulud worm

An attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and went on to spread the Shai-Hulud worm across about 100 internal code repositories, according to a Mandiant account reported on 16 September 2026.

The sequence described by Mandiant is unusual because the assistant itself became part of the delivery chain. Before the worm reached the repositories, the assistant recommended software that the attacker had poisoned. That recommendation was accepted, Mandiant said. Once inside, the worm stole repository secrets and source code.

The account does not name the affected provider, and it does not identify which coding assistant was involved. It also does not say when the intrusion began or how long the attacker held the hijacked session. Mandiant is reported as describing the repository spread as happening later, after the poisoned recommendation was accepted, rather than as a single immediate step.

Two details matter for teams running similar tooling. The first is the session hijack. An AI coding assistant working inside a development environment typically inherits the developer's context and permissions, so control of a live session is control of a trusted participant in the workflow. The second is the recommendation step. A suggestion to install a particular package carries implicit authority when it comes from an assistant that a developer has been relying on all day. In this case, according to the report, that suggestion pointed at software the attacker had already tampered with, and it was accepted.

The theft of repository secrets is the part most likely to widen the damage. Secrets stored in code repositories are often credentials for other systems, which is what allows a worm to keep moving rather than stopping at its first foothold. The reported total of about 100 repositories suggests the spread was not contained to a single team's codebase. Source code was taken as well, Mandiant said.

The incident is currently a single reported account rather than a confirmed disclosure from the affected company. No advisory from the SaaS provider has been reported, and no fix or mitigation guidance has been attached to the case in the reporting so far. Mandiant has not, in the reported material, attributed the activity to a named group, and the report does not describe how the attacker obtained access to the assistant session in the first place.

For organisations using coding assistants with repository access, the practical questions raised by the report are about scope: what an assistant session can reach, whether package installation suggestions are reviewed independently of the assistant, and whether secrets sitting in repositories would let a single compromise become a hundred.