{"schema_version":"0.10.0","id":"LR-2026-0714","record_version":1,"title":"Shai-Hulud worm spreads via hijacked AI coding assistant session","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":52.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.84,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"1a41f5b150e114b50accf504bd0f950037b33058d663ad65c0c438a9107daf8e"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-16","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Mandiant reports that an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider. Before the worm spread, the assistant recommended software the attacker had poisoned, and the recommendation was accepted. The attacker then used the developer's active session to install an infostealer through a poisoned PyPI package and stole GitHub OAuth tokens. The Shai-Hulud worm spread across about 100 internal code repositories, and the worm stole repository secrets and source code for the company's products. The attacker also poisoned a package in the company's official namespace, and another employee pulled the compromised version. The public case study does not say when the intrusion happened or how the session was taken over. Mandiant recommends checking AI-recommended dependencies against checksums and allowlists and keeping secrets out of direct reach of extensions.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK03","secondary_risks":["RK04"],"control_chain":[{"layer":"L3","party":"deployer","party_name":null,"control_id":"A1","outcome":"failed","reason":null,"quote":"The attacker leveraged the AI agent’s session credentials, which had broad repository access, to propagate the worm, exfiltrate secrets, and poison software supply chains.","source_index":1,"reviewed":false},{"layer":"L3","party":"deployer","party_name":null,"control_id":"F2","outcome":"missing","reason":null,"quote":"The incident exploited non-human identity (NHI) governance failures, as the AI agent operated with persistent, broadly scoped credentials and lacked behavioral monitoring.","source_index":1,"reviewed":false}],"remediations":[{"by":null,"kind":"advice","date_reported":null,"controls_added":["A4"],"quote":"Keep raw API keys, long-lived OAuth tokens, and other secrets out of direct reach of extensions.","source_index":0,"reviewed":false},{"by":null,"kind":"advice","date_reported":null,"controls_added":["G3"],"quote":"Check AI-recommended third-party dependencies against cryptographic checksums and approved allowlists.","source_index":0,"reviewed":false},{"by":null,"kind":"advice","date_reported":null,"controls_added":["A1"],"quote":"Apply least-privilege scoping to AI agents, ensuring they have only the minimum necessary access to repositories and write permissions are granted only through human-approved workflows.","source_index":1,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Test: contained to one deployer. The quoted sentence describes one company's internal repositories and no third party is stated as touched.","harm_class":[],"affected_description":"Approximately 100 internal code repositories of one unnamed software-as-a-service provider","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/09/attacker-hijacks-ai-coding-assistant.html","publisher":"The Hacker News","date":"2026-09-16","type":"press","title":"Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.rescana.com/post/shai-hulud-worm-attack-ai-coding-assistant-session-hijack-exposes-saas-code-repositories-to-supply-chain-compromise","publisher":"Rescana","date":"2026-09-17","type":"press","title":"Shai-Hulud Worm Attack: AI Coding Assistant Session Hijack Exposes SaaS Code Repositories to Supply Chain Compromise - Rescana","archived_url":null}],"per_field_confidence":{"event.incident_class":"C","event.date_disclosed":"C","impact.affected_description":"C","context.industry":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100 internal code repositories."}],"event.date_disclosed":[{"source_index":1,"quote":"On September 16, 2026, the AI coding assistant hijack and Shai-Hulud worm incident was publicly disclosed by Mandiant and multiple outlets."}],"impact.affected_description":[{"source_index":0,"quote":"The attacker then deployed the self-spreading Shai-Hulud worm across approximately 100 internal code repositories."}],"context.industry":[{"source_index":0,"quote":"Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100 internal code repositories."}],"impact.severity":[{"source_index":0,"quote":"The worm stole repository secrets and source code for the company's products."}],"impact.severity_because":[{"source_index":0,"quote":"The worm stole repository secrets and source code for the company's products."}],"event.control_chain":[{"source_index":1,"quote":"The attacker leveraged the AI agent’s session credentials, which had broad repository access, to propagate the worm, exfiltrate secrets, and poison software supply chains."},{"source_index":1,"quote":"The incident exploited non-human identity (NHI) governance failures, as the AI agent operated with persistent, broadly scoped credentials and lacked behavioral monitoring."}],"event.remediations":[{"source_index":0,"quote":"Keep raw API keys, long-lived OAuth tokens, and other secrets out of direct reach of extensions."},{"source_index":0,"quote":"Check AI-recommended third-party dependencies against cryptographic checksums and approved allowlists."},{"source_index":1,"quote":"Apply least-privilege scoping to AI agents, ensuring they have only the minimum necessary access to repositories and write permissions are granted only through human-approved workflows."}],"event.summary":[{"source_index":0,"quote":"Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100 internal code repositories."},{"source_index":0,"quote":"Before the repository spread, the assistant recommended software that the attacker had poisoned, and the recommendation was accepted."},{"source_index":0,"quote":"After the recommendation was accepted, the attacker used the developer's active session to install an infostealer through a poisoned PyPI package."},{"source_index":0,"quote":"The attacker also stole GitHub OAuth tokens."},{"source_index":0,"quote":"The attacker then deployed the self-spreading Shai-Hulud worm across approximately 100 internal code repositories."},{"source_index":0,"quote":"The worm stole repository secrets and source code for the company's products."},{"source_index":0,"quote":"The attacker also poisoned a package in the company's official namespace."},{"source_index":0,"quote":"Another employee pulled the compromised version, causing a second infection."},{"source_index":0,"quote":"The public case study does not say when the intrusion happened or how the attacker took over the active coding-assistant session."},{"source_index":0,"quote":"Check AI-recommended third-party dependencies against cryptographic checksums and approved allowlists."},{"source_index":0,"quote":"Keep raw API keys, long-lived OAuth tokens, and other secrets out of direct reach of extensions."}]},"notes_on_gaps":"Sources do not state when the intrusion happened, how the session was taken over, the AI model, developer, autonomy level, or whether a production deployment was involved. No detection method, trigger, adversary type, root cause, responsible party, duration, or containment time is stated, so those fields are omitted. Failure class is omitted because the sources describe a hijacked session rather than an autonomous agent failure. The A4 link is my judgement from the stolen secrets and the vendor's advice. The F2 link relies on Rescana's statement about lacking behavioural monitoring. Rescana is a vendor and its claims about permissions and persistence are not confirmed by Mandiant, so the Mandiant case study was preferred where it speaks. Mandiant's report is cited through The Hacker News. The related Shai-Hulud campaigns (May and August 2026) are excluded because both sources say they are not linked to this intrusion. Impact harm class, third-party counts, records exposed, and financial loss are not stated and are omitted. The severity tier minor is my judgement from the single-company scope stated in the sources. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":"software-as-a-service","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"An attacker hijacked an active AI coding assistant session at an unnamed SaaS provider.","quote":"Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100 internal code repositories.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The assistant recommended poisoned software and the recommendation was accepted.","quote":"Before the repository spread, the assistant recommended software that the attacker had poisoned, and the recommendation was accepted.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/09/attacker-hijacks-ai-coding-assistant.html","https://www.rescana.com/post/shai-hulud-worm-attack-ai-coding-assistant-session-hijack-exposes-saas-code-repositories-to-supply-chain-compromise"]},"analysis":{"sections":{"timeline":[{"text":"Assistant recommended poisoned software before the repository spread; recommendation accepted.","quote":"Before the repository spread, the assistant recommended software that the attacker had poisoned, and the recommendation was accepted.","source_index":0,"when":null},{"text":"Attacker used the developer's active session to install an infostealer through a poisoned PyPI package.","quote":"After the recommendation was accepted, the attacker used the developer's active session to install an infostealer through a poisoned PyPI package.","source_index":0,"when":null},{"text":"Attacker deployed the self-spreading Shai-Hulud worm across approximately 100 internal code repositories.","quote":"The attacker then deployed the self-spreading Shai-Hulud worm across approximately 100 internal code repositories.","source_index":0,"when":null},{"text":"The case appears in Mandiant's September 2026 report.","quote":"The case appears in Mandiant's September 2026 report.","source_index":0,"when":"2026-09"},{"text":"Incident publicly disclosed by Mandiant and multiple outlets.","quote":"On September 16, 2026, the AI coding assistant hijack and Shai-Hulud worm incident was publicly disclosed by Mandiant and multiple outlets.","source_index":1,"when":"2026-09-16"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/09/attacker-hijacks-ai-coding-assistant.html","https://www.rescana.com/post/shai-hulud-worm-attack-ai-coding-assistant-session-hijack-exposes-saas-code-repositories-to-supply-chain-compromise"]}}