{"schema_version":"0.10.0","id":"LR-2026-0314","record_version":1,"title":"Shai-Hulud worm spreads from hijacked AI coding-assistant session at a SaaS provider","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":48.8,"score_breakdown":{"source_authority":16.5,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.84,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"11624234352cd94d7b39bcd7c8929a3779b5b3d6329f46d1b4dd64efaba5efea"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-18","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"An AI coding assistant session on a developer’s workstation at an unnamed software-as-a-service provider was hijacked by an attacker, according to Mandiant’s report as summarised by CSA. The assistant recommended an external package the attacker had already poisoned. After the developer accepted it, the attacker used the live session to install an information stealer through a compromised PyPI package and harvest GitHub OAuth tokens. The worm then used those tokens to self-propagate across roughly 100 internal repositories and exfiltrate repository secrets and source code. It also republished a poisoned package in the company’s npm namespace, infecting a second employee. Mandiant did not disclose how the attacker took over the session. Mandiant’s recommended controls target propagation rather than initial access.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":"external package recommended by the assistant that the attacker had already poisoned","time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK06","secondary_risks":["RK03"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: moderate requires a bounded scope stated. Scope stated as roughly 100 internal code repositories. Touch of third-party data is not stated, so the tier is a judgement.","harm_class":[],"affected_description":"roughly 100 internal code repositories","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-shai-hulud-ai-coding-assistant-20260918-cs/","publisher":"Cloud Security Alliance","date":"2026-09-18","type":"independent_investigation","title":"AI Coding Assistant Hijack Spreads Shai-Hulud Worm","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"event.incident_class":"C","event.agent_involved":"C","event.input_provenance":"C","context.industry":"C","impact.affected_description":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Mandiant’s “AI Risk and Resilience Report 2026” discloses a supply chain intrusion at an unnamed software-as-a-service provider in which an attacker hijacked an active AI coding-assistant session on a developer’s workstation and used it to seed the Shai-Hulud worm across roughly 100 internal code repositories [1][2]."}],"event.agent_involved":[{"source_index":0,"quote":"Mandiant’s “AI Risk and Resilience Report 2026” discloses a supply chain intrusion at an unnamed software-as-a-service provider in which an attacker hijacked an active AI coding-assistant session on a developer’s workstation and used it to seed the Shai-Hulud worm across roughly 100 internal code repositories [1][2]."}],"event.input_provenance":[{"source_index":0,"quote":"According to the public case study, the assistant recommended an external package that the attacker had already poisoned; once the developer accepted that recommendation, the attacker used the live session to install an information stealer through a compromised PyPI package and harvested the developer’s GitHub OAuth tokens, which the worm then used to self-propagate and exfiltrate repository secrets and source code [1]."}],"context.industry":[{"source_index":0,"quote":"Mandiant’s “AI Risk and Resilience Report 2026” discloses a supply chain intrusion at an unnamed software-as-a-service provider in which an attacker hijacked an active AI coding-assistant session on a developer’s workstation and used it to seed the Shai-Hulud worm across roughly 100 internal code repositories [1][2]."}],"impact.affected_description":[{"source_index":0,"quote":"Mandiant’s “AI Risk and Resilience Report 2026” discloses a supply chain intrusion at an unnamed software-as-a-service provider in which an attacker hijacked an active AI coding-assistant session on a developer’s workstation and used it to seed the Shai-Hulud worm across roughly 100 internal code repositories [1][2]."}],"impact.severity":[{"source_index":0,"quote":"Mandiant’s “AI Risk and Resilience Report 2026” discloses a supply chain intrusion at an unnamed software-as-a-service provider in which an attacker hijacked an active AI coding-assistant session on a developer’s workstation and used it to seed the Shai-Hulud worm across roughly 100 internal code repositories [1][2]."}],"impact.severity_because":[{"source_index":0,"quote":"Mandiant’s “AI Risk and Resilience Report 2026” discloses a supply chain intrusion at an unnamed software-as-a-service provider in which an attacker hijacked an active AI coding-assistant session on a developer’s workstation and used it to seed the Shai-Hulud worm across roughly 100 internal code repositories [1][2]."}],"event.summary":[{"source_index":0,"quote":"Mandiant’s “AI Risk and Resilience Report 2026” discloses a supply chain intrusion at an unnamed software-as-a-service provider in which an attacker hijacked an active AI coding-assistant session on a developer’s workstation and used it to seed the Shai-Hulud worm across roughly 100 internal code repositories [1][2]."},{"source_index":0,"quote":"According to the public case study, the assistant recommended an external package that the attacker had already poisoned; once the developer accepted that recommendation, the attacker used the live session to install an information stealer through a compromised PyPI package and harvested the developer’s GitHub OAuth tokens, which the worm then used to self-propagate and exfiltrate repository secrets and source code [1]."},{"source_index":0,"quote":"A second employee was infected when the worm republished a poisoned package inside the company’s own npm namespace [1]."},{"source_index":0,"quote":"Mandiant did not name the victim, disclose when the intrusion occurred, or explain how the attacker gained control of the assistant session in the first place, leaving the initial-access vector as the case study’s most significant open question [1][2]."},{"source_index":0,"quote":"Mandiant’s three recommended controls for AI-assisted development, checking AI-recommended third-party dependencies against cryptographic checksums and approved allowlists, keeping raw API keys and long-lived OAuth tokens out of direct reach of assistant extensions, and routing dependency traffic through controlled internal repositories, target the propagation phase of the attack rather than the initial-access phase [1][3]."}]},"notes_on_gaps":"Only one source was supplied: a CSA note summarising a Mandiant report that was not itself provided. Not stated: model, developer, harness, tools, permissions, autonomy, deployment context; date of occurrence and exact disclosure date (only 'September 2026' appears, so date fields are omitted); detection method, root cause, trigger, adversarial actor, responsible party; direct loss, record and third-party counts; containment time; any control stated as held, failed, bypassed or missing in this incident, so links is empty. Initial-access vector is undisclosed. Severity 'moderate' and its test are my judgement from the bounded roughly-100-repository scope. The remediation entry is advice from the source (Mandiant's recommended controls), not a change reported by the victim; controls G3 and A4 were mapped by me from the recommendation wording. The original Shai-Hulud campaign, Shai-Hulud 2.0, and Miasma are other incidents and were excluded. The TeamPCP attribution is not established as the same operator. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":"software-as-a-service","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"An attacker hijacked an active AI coding assistant session on a developer’s workstation at a SaaS provider.","quote":"Mandiant’s “AI Risk and Resilience Report 2026” discloses a supply chain intrusion at an unnamed software-as-a-service provider in which an attacker hijacked an active AI coding-assistant session on a developer’s workstation and used it to seed the Shai-Hulud worm across roughly 100 internal code repositories [1][2].","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The assistant recommended a poisoned package. After the developer accepted it, the attacker installed an information stealer and harvested GitHub OAuth tokens.","quote":"According to the public case study, the assistant recommended an external package that the attacker had already poisoned; once the developer accepted that recommendation, the attacker used the live session to install an information stealer through a compromised PyPI package and harvested the developer’s GitHub OAuth tokens, which the worm then used to self-propagate and exfiltrate repository secrets and source code [1].","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://labs.cloudsecurityalliance.org/research/csa-research-note-shai-hulud-ai-coding-assistant-20260918-cs/"]},"analysis":{"sections":{"timeline":[{"text":"Attacker hijacks an active AI coding-assistant session on a developer’s workstation.","quote":"Mandiant’s “AI Risk and Resilience Report 2026” discloses a supply chain intrusion at an unnamed software-as-a-service provider in which an attacker hijacked an active AI coding-assistant session on a developer’s workstation and used it to seed the Shai-Hulud worm across roughly 100 internal code repositories [1][2].","source_index":0,"when":null},{"text":"Developer accepts poisoned package recommendation; information stealer installed; GitHub OAuth tokens harvested; worm self-propagates and exfiltrates secrets and source code.","quote":"According to the public case study, the assistant recommended an external package that the attacker had already poisoned; once the developer accepted that recommendation, the attacker used the live session to install an information stealer through a compromised PyPI package and harvested the developer’s GitHub OAuth tokens, which the worm then used to self-propagate and exfiltrate repository secrets and source code [1].","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://labs.cloudsecurityalliance.org/research/csa-research-note-shai-hulud-ai-coding-assistant-20260918-cs/"]}}