Ledger / 15 Sep 2026
Attacker hijacks developer's live AI coding session to spread Shai-Hulud worm
Confirmed
Mandiant investigated the intrusion directly (case study 1).
After compromising a SaaS provider the actor hijacked an active AI coding assistant session whose recommendation installed a poisoned package. The attacker then used the session to deploy the self-propagating Shai-Hulud worm. Report and incident dates are approximate.
“hijacked an active AI coding assistant session on a developer's workstation”Mandiant / Google Cloud
Sources
- AI risk and resilience in 2026: A Mandiant special reportMandiant / Google Cloud · 15 Sep 2026 · primary source
- Disclosed
- 15 Sep 2026
- Activity
- 2026
- Actor
- Unnamed (unknown), as attributed by Mandiant / Google Cloud
- Targets
- A SaaS provider and its developers (about 100 internal repos)
- What the AI did
- Agent hijack, Supply chain, Malware dev, Ops automation, Evasion
- Model
- unspecified LLM
- Model family
- Unspecified
- Model basis
- unknown
- Autonomy
- assist
- Outcome
- Poisoned PyPI package installed, GitHub OAuth tokens stolen, worm deployed across ~100 repos, source code exfiltrated.