ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About Hijacked coding assistant session recommends poisoned package; Shai-Hulud spreads across about 100 repositories

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Unnamed SaaS provider· AI coding assistant (product not named)

Hijacked coding assistant session recommends poisoned package; Shai-Hulud spreads across about 100 repositories

An attacker hijacked a developer's active AI coding assistant session; the assistant recommended a poisoned package, and once it was accepted the Shai-Hulud worm spread across about 100 internal repositories.

Case study 1 in Mandiant's September 2026 AI risk and resilience report. Mandiant says a threat actor compromised a SaaS provider and hijacked an active coding assistant session on a developer's workstation. The assistant recommended an external package the attacker had poisoned. After the recommendation was accepted, the attacker used the session to install an infostealer via a poisoned PyPI package, took GitHub OAuth tokens and deployed the Shai-Hulud worm across about 100 internal repositories, taking repository secrets and product source code. A package in the company's own namespace was then poisoned and a second employee pulled it. The report does not name the victim or the assistant, give a date, or say how the session was taken over. A person accepted the recommendation, so the assistant's own actions are limited to the recommendation.

First incident action to disclosure
Unknown
First incident action to discovery
Not disclosed
Noticed first by
Not disclosed
Caught
Not disclosed

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. Not disclosed

    First incident action

    Attacker compromises a SaaS provider and hijacks an active coding assistant session on a developer's workstation

    Mandiant does not say how the session was taken over.

    Reported

  2. Not disclosed

    The assistant recommends installing a poisoned external package and the recommendation is accepted

    The report does not say who accepted it; the secondary write-ups describe it as the developer accepting.

    Reported

  3. Not disclosed

    Attacker uses the live session to install an infostealer through a poisoned PyPI package and take GitHub OAuth tokens

    The worm then ran across about 100 internal repositories, taking repository secrets and product source code.

    Reported

  4. Not disclosed

    A package in the organisation's official namespace is poisoned and a second employee pulls it

    A secondary downstream infection.

    Reported

  5. 16 Sep 2026

    Disclosed

    Mandiant publishes the case in its AI risk and resilience report

    Victim and assistant not named.

    Reported

Agent failures

Hijacked by an attacker, Supply chain compromise, Credential misuse, Data exfiltrationShow
Map to frameworks

  • Hijacked by an attacker

    An attacker took over an active coding assistant session. Mandiant does not say how.

  • Supply chain compromise

    The assistant recommended a poisoned package, then a poisoned PyPI package carried an infostealer and the worm poisoned a package in the company's own namespace.

  • Credential misuse

    GitHub OAuth tokens were harvested and used to spread the worm.

  • Data exfiltration

    Repository secrets and proprietary product source code were stolen.

How it was found

Found first by not disclosed, from not disclosedShow
Found first by
Not disclosed
How
Not disclosed
Found to disclosed
Not disclosed

Not disclosed. Mandiant says it investigated the intrusion but not how it was first noticed or by whom.

What is publicly known

0 of 12 fully publicShow
0 of 12 fully public
ItemPublic?DetailSources
UnknownThe assistant product and model are not named.
UnknownNot stated.
WeakMandiant's recommended hooks and allowlists imply none were enforced; what was in place is not stated.
UnknownNot stated.
UnknownWhat the developer was doing in the session is not described.
WeakAn AI coding assistant on a developer workstation with reach to PyPI and GitHub OAuth tokens; product, tools and permissions not named.
WeakMandiant recommends restricting workstation egress, implying dependencies could be fetched directly; the actual setup is not described.
UnknownNo session transcript or logs published.
UnknownNot stated how it was detected.
PartialAbout 100 internal repositories hit, repository secrets and product source code taken, a second employee infected. Victim anonymised; no customer impact stated.
WeakMandiant describes the chain from session hijack to poisoned recommendation but does not say how the session was taken over.
WeakMandiant lists recommended controls. It does not say what the victim changed.

Controls that apply

  • Govern

    Vet, pin and change-control what agents load

    The assistant recommended an external package the attacker had poisoned, and a poisoned PyPI package delivered the infostealer. Checking AI-recommended dependencies against cryptographic checksums and an approved allowlist, as Mandiant recommends, would have flagged the package before it was installed.

  • Protect

    Give agents their own scoped, short-lived credentials

    GitHub OAuth tokens on the developer workstation were harvested and used by the worm across about 100 internal repositories. Mandiant recommends keeping raw API keys and long-lived OAuth tokens away from assistant extensions; short-lived, narrow tokens would have limited how far the worm reached.

  • Limit where the agent can send traffic

    Mandiant recommends routing all dependency traffic through internal repositories, such as an internal artifact registry. A direct install from the public registry would then have been refused or raised, and exfiltration of source code and repository secrets would have been visible at that point.

  • Detect

    Record every agent action, outside the agent

    A record of what the hijacked session did, kept outside the assistant, would show the package install, the infostealer and the use of the GitHub tokens. Mandiant does not say how the session was taken over, and that record is where an investigation of it would start.

  • Monitor every run and alert on what does not fit the task

    Mandiant does not say how the intrusion was first noticed. Monitoring would have flagged an assistant session installing a package from outside the approved set, followed by GitHub tokens being used across about 100 repositories, activity out of line with one developer's task.

  • All controls →

Coverage and commentary

1 statement, 2 articlesShow

What the parties involved said

  • Mandiant

    Says the assistant 'inadvertently functioned as a trojan horse'. Recommends dependency checks, isolated credentials and internal-only dependency traffic.

All 3 sources

  1. Primary source

    AI risk and resilience in 2026: A Mandiant special report ↗Google Cloud (Mandiant) · 2026-09-16

  2. Press

    One runaway AI agent racked up a $50,000 cloud bill ↗Help Net Security · 2026-09-16

  3. Commentary

    AI Coding Assistant Hijack Spreads Shai-Hulud Worm ↗Cloud Security Alliance Lab Space · 2026-09-18

Entry id unnamed-saas-coding-assistant-shai-hulud-2026 · overall Reported · impact serious