AI Assistant Hijacked: How One Session Leaked 100 Repos

Emily Davis · 2026-09-16

Imagine you're working late, and your AI coding assistant is humming along, suggesting libraries and writing code. Now imagine that assistant is actually working for someone else. That's exactly what happened at a software-as-a-service provider, according to a new report from Mandiant. An attacker hijacked an active AI coding-assistant session and used it to spread a nasty worm called Shai-Hulud across roughly 100 internal code repositories. It wasn't a smash-and-grab. It was a slow, quiet infiltration that turned a helpful tool into a weapon. ### How the Attack Unfolded Here's the kicker: before the worm spread, the AI assistant recommended a piece of software that the attacker had poisoned. And someone accepted that recommendation. That's all it took. The malicious package got installed, and from there, Shai-Hulud did what worms do best—it spread. - The attacker didn't break down the door. They simply slipped in through a trusted channel. - The AI assistant became an unwitting accomplice, suggesting malware as if it were a helpful library. - Once inside, the worm moved laterally, infecting repository after repository. ### What Shai-Hulud Stole The worm wasn't just making a mess. It had a purpose: steal repository secrets and source code. That means API keys, credentials, proprietary algorithms—anything developers thought was safely tucked away in their repos. For a SaaS provider, that's a nightmare scenario. Their entire business model often relies on keeping customer data and code secure. And the worst part? The attacker didn't need to be a genius. They just needed patience and a good understanding of how AI assistants work. ### Why This Matters for Your Security If you're using AI coding assistants—and let's be honest, who isn't these days?—this story should make you pause. These tools are powerful, but they're not infallible. They can be manipulated. They can be tricked into recommending malicious packages. And if your team blindly trusts those recommendations, you're playing Russian roulette with your codebase. > "The line between helpful and harmful is thinner than we think, especially when AI is involved." So what can you do? First, don't treat AI suggestions as gospel. Verify every package before you install it. Check the source, read the reviews, look for red flags. Second, limit the permissions of your AI assistant. Does it really need access to all your repositories? Probably not. Third, monitor your repositories for unusual activity. If a new package suddenly appears, investigate. ### The Bigger Picture This incident is a wake-up call. As AI becomes more integrated into our workflows, attackers will find new ways to exploit that trust. They'll poison datasets, manipulate recommendations, and hijack sessions. The question is: will you be ready? For developers and security teams, the takeaway is clear: trust, but verify. AI can be a fantastic ally, but it can also be a Trojan horse. Stay vigilant, keep your guard up, and never assume that a recommendation is safe just because it came from a smart-sounding assistant. After all, the next Shai-Hulud might be lurking in your next AI suggestion.