Cases › security breach › LR-2026-0714

Shai-Hulud worm spreads via hijacked AI coding assistant session

Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report

Status: advice only, no fix reported

Severity minor

Reported 16 Sep 2026

Industry software-as-a-service

No source states: loss or records, developer and model, agent tool, could do, deployer.

Severity minor: Test: contained to one deployer. The quoted sentence describes one company's internal repositories and no third party is stated as touched.

Mandiant reports that an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider. Before the worm spread, the assistant recommended software the attacker had poisoned, and the recommendation was accepted. The attacker then used the developer's active session to install an infostealer through a poisoned PyPI package and stole GitHub OAuth tokens. The Shai-Hulud worm spread across about 100 internal code repositories, and the worm stole repository secrets and source code for the company's products. The attacker also poisoned a package in the company's official namespace, and another employee pulled the compromised version. The public case study does not say when the intrusion happened or how the session was taken over. Mandiant recommends checking AI-recommended dependencies against checksums and allowlists and keeping secrets out of direct reach of extensions.

What happened

1 · What it was doingAn attacker hijacked an active AI coding assistant session at an unnamed SaaS provider.

2 · What went wrongThe assistant recommended poisoned software and the recommendation was accepted.

What was done

Advice in source, not a fix by the party

“Keep raw API keys, long-lived OAuth tokens, and other secrets out of direct reach of extensions.”

Secrets kept out of the model's context

Risks

Credential and privilege abuse
Primary37 incidents

Data leaked or sent out
Also32 incidents

Read from the sources; not yet reviewed by a person.

Controls

Application

Not effective Least-privilege access for the agent
Did not exist Live behaviour monitoring

Control failure chain

L1 · Model Not stated in sourcesProvider not named

L2 · Harness Not stated in sourcesHarness not named

L3 · Application Did not existDeployer not named

L4 · Infrastructure / target Not stated in sourcesOrganisation hit

L1 · ModelProvider not namedModel provider

No source mentions a control at this layer.

Model version not linked to a model card.

L2 · HarnessHarness not namedAgent framework vendor

No source mentions a control at this layer.

L3 · ApplicationDeployer not namedDeployer

Not effectiveLeast-privilege access for the agent“The attacker leveraged the AI agent’s session credentials, which had broad repository access, to propagate the worm, exfiltrate secrets, and poison software supply chains.”Rescana

Did not existLive behaviour monitoring“The incident exploited non-human identity (NHI) governance failures, as the AI agent operated with persistent, broadly scoped credentials and lacked behavioral monitoring.”Rescana

Other controls for this risk at this layer, not mentioned in the sources: Short-lived, scoped credentials, Secrets kept out of the model's context, Separate identity for each agent, Alerts on unusual tool use, Activity logs, Sensitive-data checks on outbound data.

L4 · Infrastructure / targetOrganisation hit

No source mentions a control at this layer.

Other controls for this risk at this layer, not mentioned in the sources: Multi-factor sign-in and password policy, Secrets scanning.

EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target

Controls for this risk: result in this incident

Control	Part of the system	Result
Least-privilege access for the agent	L3 Application	Not effective
Live behaviour monitoring	L3 Application	Did not exist
Separate identity for each agent	L3 Application	Not stated in sources
Short-lived, scoped credentials	L3 Application	Not stated in sources
Secrets kept out of the model's context	L3 Application	Not stated in sources
Activity logs	L3 Application	Not stated in sources
Alerts on unusual tool use	L3 Application	Not stated in sources
Sensitive-data checks on outbound data	L3 Application	Not stated in sources
Multi-factor sign-in and password policy	L4 Infrastructure / target	Not stated in sources
Secrets scanning	L4 Infrastructure / target	Not stated in sources

Similar incidents

Shai-Hulud worm spreads from hijacked AI coding-assistant session at a SaaS provider2026-09-18

All cases of this kind ›

Evidence

No source states: what it reached or did, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 5 items from the primary sources

What happened, in order

2026-09 The case appears in Mandiant's September 2026 report.
2026-09-16 Incident publicly disclosed by Mandiant and multiple outlets.

Not dated in the sources:

Assistant recommended poisoned software before the repository spread; recommendation accepted.
Attacker used the developer's active session to install an infostealer through a poisoned PyPI package.
Attacker deployed the self-spreading Shai-Hulud worm across approximately 100 internal code repositories.

Show every field, with its source and grade

What happened

Earliest source we hold

2026-09-16

C one secondary source states it

What went wrong

security breach

C one secondary source states it

primary risk

RK03

D inferred by us from the described behaviour, reason shown

secondary risks

RK04

D inferred by us from the described behaviour, reason shown

control chain

layer: L3; party: deployer; control id: A1; outcome: failed; quote: The attacker leveraged the AI agent’s session credentials, which had broad repository access, to propagate the worm, exfiltrate secrets, and poison software supply chains.; source index: 1, layer: L3; party: deployer; control id: F2; outcome: missing; quote: The incident exploited non-human identity (NHI) governance failures, as the AI agent operated with persistent, broadly scoped credentials and lacked behavioral monitoring.; source index: 1

C one secondary source states it

remediations

kind: advice; controls added: A4; quote: Keep raw API keys, long-lived OAuth tokens, and other secrets out of direct reach of extensions.; source index: 0, kind: advice; controls added: G3; quote: Check AI-recommended third-party dependencies against cryptographic checksums and approved allowlists.; source index: 0, kind: advice; controls added: A1; quote: Apply least-privilege scoping to AI agents, ensuring they have only the minimum necessary access to repositories and write permissions are granted only through human-approved workflows.; source index: 1

C one secondary source states it

Impact

Severity

minor

D inferred by us from the described behaviour, reason shown

Who was affected

Approximately 100 internal code repositories of one unnamed software-as-a-service provider

C one secondary source states it

Why this severity

Test: contained to one deployer. The quoted sentence describes one company's internal repositories and no third party is stated as touched.

D inferred by us from the described behaviour, reason shown

Context

Industry

software-as-a-service

C one secondary source states it

Notes on gaps

The F2 link relies on Rescana's statement about lacking behavioural monitoring. Mandiant's report is cited through The Hacker News. The related Shai-Hulud campaigns (May and August 2026) are excluded because both sources say they are not linked to this intrusion.

LR-2026-0714 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON