Mandiant: attacker hijacks AI coding-assistant session, spreads Shai-Hulud across ~100 repos
Mandiant AI Risk and Resilience Report 2026 (Google Cloud) case study: after compromising a SaaS provider, an attacker hijacked an active AI coding-assistant session on a developer workstation. The assistant recommended a poisoned external package; once accepted, the attacker used the session to install an infostealer via a poisoned PyPI package, harvest GitHub OAuth tokens, and deploy the self-propagating Shai-Hulud worm across about 100 internal repositories (secret theft and programmatic exfiltration).
Defenders: treat AI assistant tool-install prompts as high-risk; constrain package installs; rotate GitHub tokens; audit recent repo automation. (source: Mandiant/Google Cloud report)
Correction (02 Nov 2026): removed The Hacker News as a source. (source: Google Cloud)
- Product
- AI coding assistants; developer workstations; GitHub / PyPI supply chain
- Exploited in Australia?
- unknown
- Patch to
- Revoke exposed GitHub OAuth/tokens; remove Shai-Hulud artefacts; constrain AI assistant install capabilities; rebuild from known-good