{
  "entry": {
    "kind": "vuln",
    "slug": "mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across",
    "name": "mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across",
    "vendor": "Not a single-product CVE — IR case study of a hijacked live coding-assistant session used as the execution path for Shai-Hulud. Any assistant that can recommend and trigger dependency inst",
    "description": "Mandiant's September 2026 AI Risk and Resilience report (Google Cloud; covered by The Hacker News on 16 September 2026) documents an IR case at an unnamed SaaS provider in which a threat actor hijacked an active AI coding-assistant session on a developer workstation. The assistant, described as a trusted interpreter in the environment, recommended installing an external package the attacker had poisoned; once that recommendation was accepted, the attacker used the live session to install an infostealer via a poisoned PyPI package, harvest GitHub OAuth tokens, and deploy the self-propagating Shai-Hulud worm across approximately 100 internal code repositories — automating theft of repository secrets and programmatic exfiltration of proprietary product source code. The actor then poisoned a package in the organization's own official namespace, causing a second infection when another employee pulled the compromised version. The public case study does not disclose the intrusion date, the specific assistant product, or how the session was taken over. Mandiant's named controls for this case: IDE/CLI verification hooks that check AI-recommended third-party dependencies against cryptographic checksums and approved allowlists; isolate local credentials so extensions cannot reach raw API keys or long-lived OAuth tokens; and route dependency egress through controlled internal registries.",
    "website": "https://cloud.google.com/security/resources/ai-risk-and-resilience-2026",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-09-16",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across",
      "aliases": [
        "ti-102"
      ],
      "title": "Mandiant: Hijacked AI Coding-Assistant Session Deploys Shai-Hulud Across ~100 Internal Repos",
      "summary": "Mandiant's September 2026 AI Risk and Resilience report (Google Cloud; covered by The Hacker News on 16 September 2026) documents an IR case at an unnamed SaaS provider in which a threat actor hijacked an active AI coding-assistant session on a developer workstation. The assistant, described as a trusted interpreter in the environment, recommended installing an external package the attacker had poisoned; once that recommendation was accepted, the attacker used the live session to install an infostealer via a poisoned PyPI package, harvest GitHub OAuth tokens, and deploy the self-propagating Shai-Hulud worm across approximately 100 internal code repositories — automating theft of repository secrets and programmatic exfiltration of proprietary product source code. The actor then poisoned a package in the organization's own official namespace, causing a second infection when another employee pulled the compromised version. The public case study does not disclose the intrusion date, the specific assistant product, or how the session was taken over. Mandiant's named controls for this case: IDE/CLI verification hooks that check AI-recommended third-party dependencies against cryptographic checksums and approved allowlists; isolate local credentials so extensions cannot reach raw API keys or long-lived OAuth tokens; and route dependency egress through controlled internal registries.",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise",
        "Credential theft",
        "Malware"
      ],
      "componentType": "agent",
      "component": {
        "name": "Not a single-product CVE — IR case study of a hijacked live coding-assistant session used as the execution path for Shai-Hulud. Any assistant that can recommend and trigger dependency inst",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Not a single-product CVE — IR case study of a hijacked live coding-assistant session used as the execution path for Shai-Hulud. Any assistant that can recommend and trigger dependency installs under a developer's credentials is in scope.",
          "fixed": null
        }
      ],
      "exploited": true,
      "exploitPublic": false,
      "publishedAt": "2026-09-16",
      "modifiedAt": "2026-09-16",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://cloud.google.com/security/resources/ai-risk-and-resilience-2026"
        }
      ],
      "mitigation": "Enforce verification hooks so AI-recommended packages must match cryptographic checksums and an approved allowlist before install. Keep raw API keys and long-lived OAuth tokens out of reach of IDE extensions and agent runtimes (JIT secrets / credential isolation). Route npm/PyPI and other dependency traffic through an internal registry with egress controls. Treat coding assistants and MCP servers as privileged sessions: monitor first-time repo access and mass clone/push patterns, and be ready to revoke the developer's GitHub OAuth tokens if a session is suspected compromised. Diff .claude/settings.json and .vscode/tasks.json after any unexplained install — Shai-Hulud-family payloads have repeatedly planted persistence there.",
      "detectedByAnomity": true
    }
  }
}