Mandiant traces Shai-Hulud worm to hijacked AI coding session at unnamed SaaS firm

Mandiant documented the intrusion in its September 2026 report. After the poisoned dependency was accepted, the session installed an infostealer, exfiltrated tokens, and seeded the worm into the company's namespace. A second employee later pulled the tainted package, confirming lateral movement via official channels. Raw session access and unverified AI suggestions were the critical vectors.

Procurement records and prior Mandiant findings show attackers shifted in 2025 from AI-assisted scripting to embedding models directly in attack chains. The March 2026 report already flagged live use of LLMs for malware generation; this case demonstrates the next step—direct control of developer tooling. No independent technical attribution has been released, leaving the actor unknown.

The pattern matches separate Shai-Hulud variants that scanned 469 credential locations and hooked Claude Code plus VS Code. Controlled internal repositories and checksum validation for AI-suggested packages would have blocked both infections. Long-lived OAuth tokens stored in reachable extensions remain the persistent exposure.

Expect similar session-hijack attempts against other AI coding platforms within six months; defenders should monitor for anomalous dependency installs originating from assistant processes.