{"id":1758,"date":"2026-09-18T10:58:10","date_gmt":"2026-09-18T05:28:10","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1758"},"modified":"2026-09-21T15:01:25","modified_gmt":"2026-09-21T09:31:25","slug":"ai-coding-assistant-hijack-shai-hulud","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/ai-coding-assistant-hijack-shai-hulud\/","title":{"rendered":"AI Coding Assistant Hijack Spreads Shai-Hulud Across About 100 Repositories"},"content":{"rendered":"

An AI coding assistant hijack at an unnamed SaaS provider turned a trusted developer workflow into a software supply-chain attack path.<\/p>\n

Mandiant investigated an intrusion in which a threat actor compromised a SaaS provider and hijacked an active AI coding-assistant session on a developer\u2019s workstation. The assistant then recommended an external software package that the attacker had poisoned. Once that recommendation was accepted, the attacker used the active session to install an infostealer through a poisoned PyPI package.<\/p>\n

The intrusion did not stop at one developer endpoint. Mandiant says the attacker harvested GitHub OAuth tokens and deployed the self-propagating Shai-Hulud worm across approximately 100 internal code repositories. The worm automated repository-secret theft and source-code exfiltration.<\/p>\n

How the AI Coding Assistant Hijack Led to a Poisoned Recommendation<\/h2>\n

The distinctive part of this incident was not simply the malicious package.<\/p>\n

According to Mandiant, the AI coding assistant, whose active session had been hijacked, operated as a trusted interpreter within the developer environment. It recommended installing an external software package that the attacker had poisoned. The recommendation was then accepted.<\/p>\n

That trust decision changed the attack path<\/a>.<\/p>\n

Instead of relying only on a developer independently finding and installing a malicious dependency, the attacker exploited a workflow where an AI assistant could influence dependency selection. Mandiant says the assistant effectively became a trojan horse after the poisoned recommendation was executed.<\/p>\n

The attack path also exposes a human trust problem in AI-assisted development: developers may treat recommendations from an embedded coding assistant as operationally trustworthy rather than independently evaluating each dependency. Verifying AI-recommended packages before installation adds a human review layer before generated recommendations become executable actions.<\/p>\n

However, important initial-access details remain undisclosed. Mandiant has not publicly explained how the SaaS provider was compromised or how the attacker hijacked the active AI coding-assistant session. The report also does not identify the SaaS provider or the coding assistant involved.<\/p>\n

Therefore, organizations should not assume that a vulnerability in the unidentified AI coding assistant caused the intrusion. They also should not assume that a particular technique was used to hijack its active session.<\/p>\n

How Shai-Hulud Reached About 100 Internal Repositories<\/h2>\n

Once the poisoned recommendation was accepted, the attack moved beyond the AI assistant itself.<\/p>\n

Mandiant documented the following sequence:<\/p>\n