Executive Summary
On September 16, 2026, multiple independent sources reported that an attacker hijacked an active session of an AI coding assistant at a software-as-a-service (SaaS) provider, deploying the Shai-Hulud worm across approximately 100 internal code repositories. The attacker leveraged the AI agent’s session credentials, which had broad repository access, to propagate the worm, exfiltrate secrets, and poison software supply chains. The incident exploited non-human identity (NHI) governance failures, as the AI agent operated with persistent, broadly scoped credentials and lacked behavioral monitoring. The Shai-Hulud worm achieved persistence by injecting hooks into AI agent and editor configuration directories, enabling it to spread silently across projects and harvest credentials. The attack chain did not require privilege escalation, as the compromised AI agent’s permissions were sufficient for lateral movement and data exfiltration. This incident highlights the emerging risk of AI-driven development tools as an attack surface and underscores the need for robust credential governance, dependency verification, and behavioral monitoring in environments utilizing AI coding assistants.
Technical Information
The attack began when an adversary hijacked the session credentials of an AI coding assistant at a SaaS provider. Unlike traditional attacks targeting human developers, the attacker exploited the AI agent’s own session token, which granted broad access to internal code repositories. This non-human identity (NHI) compromise allowed the attacker to inherit all permissions assigned to the AI agent, bypassing the need for privilege escalation.
Once inside the agent’s context, the attacker used the AI assistant to recommend and install a poisoned PyPI package. This package contained an infostealer that harvested repository secrets, API keys, OAuth tokens, and source code. The attacker then deployed the self-propagating Shai-Hulud worm, which spread across approximately 100 internal repositories by injecting malicious code into pull requests and configuration files.
The Shai-Hulud worm achieved persistence by modifying configuration directories associated with AI coding assistants and code editors. For example, it injected a SessionStart hook into .claude/settings.json for Claude Code and a "runOn": "folderOpen" entry into .vscode/tasks.json for Visual Studio Code. These hooks executed malicious scripts every time a project was opened, enabling the worm to spread to additional repositories on the same machine.
The worm’s payload included a bootstrapper that downloaded Bun 1.3.14 and executed a credential harvester. This component scanned over 80 environment variables and 130 file paths for sensitive information, which it exfiltrated via encrypted HTTPS to a command-and-control (C2) server disguised as an OpenTelemetry endpoint. The worm also established system-level persistence through services such as kitty-monitor and gh-token-monitor, which polled for C2 commands and validated stolen tokens, respectively.
The attack chain mapped to several MITRE ATT&CK techniques, including Valid Accounts: Cloud Accounts (T1078.004) for session hijack, Supply Chain Compromise: Compromise Software Supply Chain (T1195.002) for poisoned package injection, Persistence via Application Layer (T1546.016) for configuration hooks, Automated Collection (T1119) for credential harvesting, Exfiltration Over Web Service (T1567.002) for data exfiltration, Masquerading (T1036) for the C2 endpoint, and Obfuscated Files or Information (T1027) for hidden persistence artifacts.
Historical context reveals that the Shai-Hulud family of malware has previously targeted developer tools and credentials. In May 2026, a compromised npm maintainer account (atool) was used to push malicious versions across over 300 packages in the @antv namespace, affecting millions of downloads. In August 2026, related attacks targeted developer tools and planted hooks for Claude Code and VS Code. However, there is no direct evidence linking these campaigns to the specific SaaS provider incident.
The incident underscores the operational risk posed by AI-driven development tools with persistent, broadly scoped credentials. The lack of monitoring for anomalous agent behavior, such as rapid cross-repo modifications by non-human identities, facilitated the worm’s propagation and persistence. The attack demonstrates the need for organizations to treat AI agent sessions as privileged identities, enforce least-privilege access, and implement robust behavioral monitoring.
Affected Versions & Timeline
The attack primarily affected internal code repositories at an unnamed SaaS provider utilizing AI coding assistants with broad repository access. The Shai-Hulud worm and its variants also impacted projects and organizations relying on packages in the @antv scope, as well as related libraries such as echarts-for-react, timeago.js, size-sensor, @tanstack, @uipath, @mistralai, @squawk, @tallyui, and @beproduct.
The timeline of verified events is as follows: Between May 11 and May 19, 2026, malicious npm packages were published, affecting the @antv and related scopes. On May 19, 2026, automated bursts of malicious package uploads began. In August 2026, related Shai-Hulud-family attacks targeted developer tools and credentials. On September 16, 2026, the AI coding assistant hijack and Shai-Hulud worm incident was publicly disclosed by Mandiant and multiple outlets.
Threat Activity
The attacker’s activity began with the compromise of an AI coding assistant’s session credentials, granting access to internal code repositories. The attacker used the AI assistant to recommend and install a poisoned PyPI package, which deployed an infostealer and enabled the spread of the Shai-Hulud worm. The worm propagated by injecting malicious hooks into configuration files for AI coding assistants and code editors, achieving persistence and lateral movement across repositories.
The worm harvested secrets, API keys, OAuth tokens, and source code, exfiltrating them to a C2 server disguised as an OpenTelemetry endpoint. The attacker also poisoned a package in the company’s official namespace, leading to a secondary infection when another employee pulled the compromised version. The attack chain did not require privilege escalation, as the AI agent’s existing permissions were sufficient for all malicious actions.
The incident exploited a lack of monitoring for anomalous agent behavior and insufficient credential governance for non-human identities. The attacker’s use of advanced supply chain techniques and persistent malware artifacts demonstrates a high level of sophistication, although no specific threat actor group has been publicly attributed.
Mitigation & Workarounds
The following mitigation steps are prioritized by severity:
Critical: Inventory all AI-agent service accounts and session credentials, and immediately rotate any that may have been exposed. Apply least-privilege scoping to AI agents, ensuring they have only the minimum necessary access to repositories and write permissions are granted only through human-approved workflows. Audit all .claude/ and .vscode/ directories across repositories for unauthorized hooks, such as SessionStart entries in .claude/settings.json, setup.mjs files, and "runOn": "folderOpen" entries in .vscode/tasks.json. Remove any persistence artifacts and terminate related processes or services, including kitty-monitor and gh-token-monitor.
High: Monitor for anomalous commit velocity and cross-repo access patterns by non-human identities. Implement behavioral monitoring to detect rapid, automated modifications across multiple repositories. Check lockfiles for package versions published between May 11 and May 19, 2026, especially for dependencies in the @antv scope and related libraries.
Medium: Enable software composition analysis (SCA) with a quality gate condition to block known malicious packages. Route dependency traffic through controlled internal repositories and verify all third-party dependencies against cryptographic checksums and approved allowlists.
Low: Educate development teams about the risks of AI-assisted development and the importance of secrets hygiene. Ensure that raw API keys, long-lived OAuth tokens, and other secrets are kept out of reach of extensions and AI agents.
Indicators of Compromise
No public indicators of compromise were available at the time of writing.
References
The Hacker News, Sep 16, 2026: https://thehackernews.com/2026/09/attacker-hijacks-ai-coding-assistant.html
IT-Learn.io, Sep 16, 2026: https://blog.it-learn.io/identity/2026-09-16-identity-ai-assistant-hijacked-shai-hulud-worm-hit-100-repos/
SonarSource, May 26, 2026: https://www.sonarsource.com/blog/mini-shai-hulud-targets-ai-coding-agents/
About Rescana
Rescana’s third-party risk management (TPRM) platform enables organizations to continuously assess and monitor the security posture of their software supply chain, including the identification of non-human identities, credential governance gaps, and anomalous behaviors in development environments. Our platform supports the detection of supply chain risks and the implementation of controls for dependency verification, secrets management, and behavioral monitoring. For further information or assistance, contact us at info@rescana.com.
