Cases › security breach › LR-2026-0314
Shai-Hulud worm spreads from hijacked AI coding-assistant session at a SaaS provider
Preliminary Why: Publisher not yet named · subject to change
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer.
Severity moderate: Test: moderate requires a bounded scope stated. Scope stated as roughly 100 internal code repositories. Touch of third-party data is not stated, so the tier is a judgement.
An AI coding assistant session on a developer’s workstation at an unnamed software-as-a-service provider was hijacked by an attacker, according to Mandiant’s report as summarised by CSA. The assistant recommended an external package the attacker had already poisoned. After the developer accepted it, the attacker used the live session to install an information stealer through a compromised PyPI package and harvest GitHub OAuth tokens. The worm then used those tokens to self-propagate across roughly 100 internal repositories and exfiltrate repository secrets and source code. It also republished a poisoned package in the company’s npm namespace, infecting a second employee. Mandiant did not disclose how the attacker took over the session. Mandiant’s recommended controls target propagation rather than initial access.
What happened
What was done
No source states an action or fix.
Risks
Primary24 incidents
Rising: 4 vs 0.2 a week
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
Harness ApplicationSigned and verified components · Vetting of plug-ins, skills and dependencies · AI bill of materials · Vulnerability scanning of AI components · Model provenance checks · Least-privilege access for the agent
Infrastructure / targetSimilar incidents
Evidence
No source states: what it reached or did, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 2 items from the primary sources
What happened, in order
Not dated in the sources:
- Attacker hijacks an active AI coding-assistant session on a developer’s workstation.
- Developer accepts poisoned package recommendation; information stealer installed; GitHub OAuth tokens harvested; worm self-propagates and exfiltrates secrets and source code.
Show every field, with its source and grade
What happened
Impact
Context
Notes on gaps
Initial-access vector is undisclosed. The remediation entry is advice from the source (Mandiant's recommended controls), not a change reported by the victim; controls G3 and A4 were mapped by me from the recommendation wording. The original Shai-Hulud campaign, Shai-Hulud 2.0, and Miasma are other incidents and were excluded. The TeamPCP attribution is not established as the same operator.
LR-2026-0314 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON