Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories

Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100 internal code repositories. Before the repository spread, the assistant recommended software that the attacker had poisoned, and the recommendation was accepted. The worm stole repository secrets and source code for the

Fact: Mandiant reports that an attacker hijacked an active AI coding-assistant session at an unnamed SaaS provider, first poisoning software that the assistant later recommended and then using the Shai-Hulud worm to spread across about 100 internal code repositories, stealing repository secrets and source code. Fact: The incident shows that compromise of an AI assistant session and its software supply chain path can rapidly propagate into internal engineering environments and sensitive code assets. RealGround analysis: Organizations relying on AI coding assistants in SaaS contexts should harden session security, enforce strict validation of AI-recommended dependencies, and isolate repositories to limit lateral movement and secret exposure. RealGround analysis: Continuous red teaming of AI workflows and supply-chain SBOM review can help detect poisoned components and abusive agent behavior before attackers turn assistant sessions into a pivot point into core code infrastructure.