Mandiant Details AI Coding Session Hijack That Spread Shai-Hulud to About 100 Repositories

Mandiant says a threat actor hijacked an active AI coding assistant session at a SaaS provider and used it to help deploy the self-propagating Shai-Hulud worm across about 100 internal code repositories. The case, detailed in AI Risk and Resilience 2026, turns a routine AI-assisted recommendation into a supply-chain breach involving a poisoned PyPI package, stolen GitHub OAuth tokens and a second downstream infection inside the company's own namespace. According to Mandiant, the attacker first compromised the provider and hijacked a developer workstation session in which the AI assistant was operating as a trusted interpreter. The assistant recommended an external software package that had been poisoned by the attacker; after the recommendation was accepted, the active session was used to install an infostealer, harvest GitHub OAuth tokens and push Shai-Hulud through internal repositories, where it automated repository-secret theft and programmatic exfiltration of proprietary product source code. The actor then poisoned a package under the organization's official namespace, and another employee pulled the compromised version, causing a follow-on infection. The disclosure matters because it collapses several previously separate risk categories: dependency poisoning, credential theft, AI coding workflows and internal package trust. Google Threat Intelligence Group and Mandiant have separately described a broader rise in open-source supply-chain compromise, including February-to-May 2026 activity by UNC6780, also known as TeamPCP, across PyPI, npm and Docker Hub, with compromised packages used to deploy credential stealers and abuse routes such as GitHub Actions pull_request_target in supply-chain compromise guidance. The practical assessment is mixed: AI coding assistants remain useful because they sit close to developer work, dependencies and tooling, but this incident shows that the same proximity can turn a recommendation into an implicit trust decision when local credentials and repository access are reachable. A separate TanStack incident analysis of the Shai-Hulud family found compromised npm packages carrying valid SLSA Build Level 3 provenance and warned that provenance identifies the pipeline that produced an artifact, not whether the pipeline was behaving safely. Mandiant's recommended controls are correspondingly concrete: validate AI-recommended third-party dependencies against cryptographic checksums and approved allowlists, isolate local credentials so extensions cannot read raw API keys, long-lived OAuth tokens or secrets, and restrict workstation egress so dependency traffic flows through secure internal repositories. The outlook is that AI coding sessions are likely to be treated less like chat windows and more like privileged development sessions that require identity controls, dependency verification, network containment and continuous behavioral telemetry.