Mandiant: Attacker Hijacked AI Coding Session, Spread Shai-Hulud Across 100 Repositories

September 16, 2026 at 06:37 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Mandiant reports an attacker hijacked an active AI coding-assistant session at an unnamed SaaS provider and spread the Shai-Hulud worm across about 100 internal code repositories. The assistant had recommended poisoned software that was accepted, leading to theft of repository secrets and source code. The case appears in Mandiant's September 2026 report, which does not disclose when the intrusion occurred or how the session was taken over.

Key Facts

Mandiant says the attacker spread the Shai-Hulud worm across about 100 internal code repositories after hijacking an active AI coding-assistant session.
The AI assistant recommended poisoned software that was accepted, and the worm stole repository secrets and source code for the company's products.
The attacker installed an infostealer through a poisoned PyPI package and stole GitHub OAuth tokens using the developer's active session.
Mandiant's September 2026 report does not state when the intrusion happened or how the attacker took over the active coding-assistant session.
In August 2026, a Keyv-linked npm worm poisoned hundreds of packages and planted hooks for Claude Code and Visual Studio Code.

Attack Sequence

After the poisoned recommendation was accepted, the attacker used the developer's active session to install an infostealer through a poisoned PyPI package. The attacker also stole GitHub OAuth tokens and then deployed the self-spreading Shai-Hulud worm across approximately 100 internal code repositories. The attacker poisoned a package in the company's official namespace, and another employee pulled the compromised version, causing a second infection.

Defensive Controls

Mandiant recommends checking AI-recommended third-party dependencies against cryptographic checksums and approved allowlists. It also advises keeping raw API keys, long-lived OAuth tokens, and other secrets out of direct reach of extensions. Mandiant further recommends routing dependency traffic through controlled internal repositories.

Related Campaigns

In August 2026, a Keyv-linked npm worm poisoned hundreds of packages and planted hooks for Claude Code and Visual Studio Code. A later analysis found a Shai-Hulud variant scanning 469 locations for credentials across developer systems, CI/CD tools, cloud configurations, and AI tool files. These were separate campaigns, and the available evidence does not link them to the unnamed Mandiant intrusion.