# mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across: Mandiant: Hijacked AI Coding-Assistant Session Deploys Shai-Hulud Across ~100 Internal Repos

> Mandiant: Hijacked AI Coding-Assistant Session Deploys Shai-Hulud Across ~100 Internal Repos is a critical-severity supply chain compromise issue in Not a single-product CVE — IR case study of a hijacked live coding-assistant session used as the execution path for Shai-Hulud. Any assistant that can recommend and trigger dependency inst, an AI agent. Affected: Not a single-product CVE — IR case study of a hijacked live coding-assistant session used as the execution path for Shai-Hulud. Any assistant that can recommend and trigger dependency installs under a developer's credentials is in scope.. It has been exploited in the wild.

- **Canonical URL:** https://catalog.anomity.ai/vuln/mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across
- **Aliases:** ti-102
- **Severity:** critical
- **Attack type:** Supply chain compromise, Credential theft, Malware
- **Component:** Not a single-product CVE — IR case study of a hijacked live coding-assistant session used as the execution path for Shai-Hulud. Any assistant that can recommend and trigger dependency inst (AI agent)
- **Exploited in the wild:** yes
- **Published:** 2026-09-16
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across

## Summary

Mandiant's September 2026 AI Risk and Resilience report (Google Cloud; covered by The Hacker News on 16 September 2026) documents an IR case at an unnamed SaaS provider in which a threat actor hijacked an active AI coding-assistant session on a developer workstation. The assistant, described as a trusted interpreter in the environment, recommended installing an external package the attacker had poisoned; once that recommendation was accepted, the attacker used the live session to install an infostealer via a poisoned PyPI package, harvest GitHub OAuth tokens, and deploy the self-propagating Shai-Hulud worm across approximately 100 internal code repositories — automating theft of repository secrets and programmatic exfiltration of proprietary product source code. The actor then poisoned a package in the organization's own official namespace, causing a second infection when another employee pulled the compromised version. The public case study does not disclose the intrusion date, the specific assistant product, or how the session was taken over. Mandiant's named controls for this case: IDE/CLI verification hooks that check AI-recommended third-party dependencies against cryptographic checksums and approved allowlists; isolate local credentials so extensions cannot reach raw API keys or long-lived OAuth tokens; and route dependency egress through controlled internal registries.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Not a single-product CVE — IR case study of a hijacked live coding-assistant session used as the execution path for Shai-Hulud. Any assistant that can recommend and trigger dependency installs under a developer's credentials is in scope. | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run Not a single-product CVE — IR case study of a hijacked live coding-assistant session used as the execution path for Shai-Hulud. Any assistant that can recommend and trigger dependency installs under a developer's credentials is in scope..

## How do I fix it?

Enforce verification hooks so AI-recommended packages must match cryptographic checksums and an approved allowlist before install. Keep raw API keys and long-lived OAuth tokens out of reach of IDE extensions and agent runtimes (JIT secrets / credential isolation). Route npm/PyPI and other dependency traffic through an internal registry with egress controls. Treat coding assistants and MCP servers as privileged sessions: monitor first-time repo access and mass clone/push patterns, and be ready to revoke the developer's GitHub OAuth tokens if a session is suspected compromised. Diff .claude/settings.json and .vscode/tasks.json after any unexplained install — Shai-Hulud-family payloads have repeatedly planted persistence there.

## How do I find every machine running Not a single-product CVE — IR case study of a hijacked live coding-assistant session used as the execution path for Shai-Hulud. Any assistant that can recommend and trigger dependency inst?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Not a single-product CVE — IR case study of a hijacked live coding-assistant session used as the execution path for Shai-Hulud. Any assistant that can recommend and trigger dependency inst and which version, then enforce a policy on it.

## References

- article: https://cloud.google.com/security/resources/ai-risk-and-resilience-2026

## Related vulnerabilities

- [keyv-cacheable-npm-worm-writes-auto-run-hooks-into-claude-settings-json](https://catalog.anomity.ai/vuln/keyv-cacheable-npm-worm-writes-auto-run-hooks-into-claude-settings-json) — critical
- [asyncapi-npm-packages-backdoored-with-miasma-malware-framework](https://catalog.anomity.ai/vuln/asyncapi-npm-packages-backdoored-with-miasma-malware-framework) — critical
- [mini-shai-hulud-170-npm-pypi-packages-compromised-in-coordinated](https://catalog.anomity.ai/vuln/mini-shai-hulud-170-npm-pypi-packages-compromised-in-coordinated) — critical
- [self-propagating-npm-supply-chain-worm-targets-ai-agent-packages](https://catalog.anomity.ai/vuln/self-propagating-npm-supply-chain-worm-targets-ai-agent-packages) — critical
- [litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook](https://catalog.anomity.ai/vuln/litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook) — critical
- [symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot](https://catalog.anomity.ai/vuln/symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across