An AI Coding Assistant Became a Trojan Horse

Mandiant’s new AI Risk and Resilience Report 2026 discloses a case study in which an attacker compromised a software as a service provider, hijacked an active AI coding assistant session on a developer’s workstation, and used it to spread the self propagating Shai-Hulud worm across roughly 100 internal code repositories. The assistant, described by Mandiant as operating as “a trusted interpreter within the environment,” recommended installing an external package the attacker had poisoned; once the developer accepted that recommendation, the attacker used the live session to install an infostealer through a poisoned PyPI package, harvest GitHub OAuth tokens, and launch the worm.

Why it matters: this is not a case of an attacker breaking into a developer’s machine and then separately deploying malware. The AI assistant itself was the delivery mechanism, accepted as a trusted advisor and never flagged as the intrusion point. The worm then poisoned a package inside the company’s own official namespace, causing a second infection when another employee pulled the compromised update, a self reinforcing spread pattern that required no further attacker action.

The original insight is what this does to the trust model of AI assisted development itself. Traditional supply chain defenses assume the danger is an external package; here the danger was the recommendation layer that developers rely on to choose those packages in the first place, a distinction The Supply Chain Worm Now Hunts AI Agent Credentials also found in a related but separate Shai-Hulud variant. Mandiant’s recommended controls, checking AI recommended dependencies against cryptographic checksums and approved allowlists, isolating extensions from raw API keys and OAuth tokens, and routing dependency traffic through internal repositories, treat the assistant as an untrusted intermediary by default rather than a shortcut past normal verification, a shift Attackers Don’t Need an Exploit. They Ask the Agent. argued was overdue months before this case surfaced.

Source: Mandiant