A hijacked AI coding assistant session spread Shai-Hulud to about 100 internal repositories
Mandiant describes an intrusion at an unnamed SaaS provider where a poisoned package, recommended through a developer's AI coding assistant session, led to stolen GitHub OAuth tokens and the Shai-Hulud worm in roughly 100 internal repositories.
Mandiant's September 2026 AI risk report describes an intrusion at an unnamed software-as-a-service provider that started inside a developer's AI coding assistant session. The assistant recommended software the attacker had poisoned, and the developer accepted it. The attacker then used that active session to install an infostealer through a poisoned PyPI package, took the developer's GitHub OAuth tokens, and deployed the self-spreading Shai-Hulud worm across about 100 internal code repositories. A second infection followed when the attacker poisoned a package in the company's own official namespace and another employee pulled it. Mandiant does not say how the session was first taken over. Its three recommended controls: verify AI-recommended dependencies against checksums and allowlists, keep secrets away from editor extensions, and route dependency traffic through controlled repositories.
Why it matters
The assistant is not the identity that got abused here; the developer is. Everything the attacker did ran on credentials the developer's machine already held, and the GitHub OAuth tokens on that machine were broad enough to seed a hundred repositories and publish into the company's trusted namespace. That is the control to check first: what a single workstation token can push, and whether publishing to an internal package namespace needs anything more than a token that happens to be on a laptop.
The AI angle matters in a narrower way than the headline suggests. An assistant's suggestion arrives with borrowed authority, and developers accept it faster than they would a random package from a search. Treat dependencies the assistant proposes exactly like dependencies a stranger proposes, which is Mandiant's first control, and keep the developer's tokens short-lived and scoped so that the next accepted suggestion cannot reach this far. See secrets in repositories and CI and agent instruction injection.
Source: The Hacker News
Related on Start with Identity
- BlogShai-Hulud reaches the Tensorlake npm SDK, with a wiper that fires when you revoke the stolen token
tensorlake@0.5.144, published from the project's own release workflow after commits pushed under a maintainer's name, carried a ChainDrop/Shai-Hulud credential
- BlogCrowdSec kept a departing engineer's GitHub access open, and lost 170 private repositories through it
An engineer's laptop was infected in the May TanStack npm attack. Eleven days later his still-active GitHub OAuth token was used to copy about 170 of CrowdSec's
- BlogDocker Hub GhostPat flaw let account conversion hand access tokens to any victim
CVE-2026-105445 (CVSS 9.4): for two years, converting a Docker Hub account into an organization re-assigned its personal access tokens to whoever was named owne
- CVEJFrog Artifactory hands its internal anonymous-user token to unauthenticated callers
Self-hosted Artifactory could return an internal anonymous-user token to an unauthenticated request even with anonymous access disabled. Attackers chained it wi
- CVETrivy release and GitHub Action tags hijacked to steal CI secrets
With credentials left valid by a non-atomic rotation, an attacker shipped a malicious Trivy v0.69.4 and repointed 76 of 77 trivy-action tags to code that dumped
- CVEJFrog Artifactory checks a token's signature and issuer but not its scope
Self-hosted Artifactory before 7.133.11 validated access token signatures and issuers without enforcing scope, so a low-privilege token could perform admin acti