AI coding assistant hijacking: attackers and worms turn developer agents into a way in

What happened

Two 2026 reports show AI coding assistant security becoming a supply chain issue: attackers are using developers’ AI tools as an entry point and treating their configuration as a target.

In its September 2026 special report on AI risk, Mandiant describes an intrusion in which a threat actor compromised a software-as-a-service provider and “hijacked an active AI coding assistant session on a developer’s workstation.” According to Mandiant, the assistant, “operating as a trusted interpreter within the environment,” recommended an external package the attacker had poisoned. Once that was accepted, the attacker used the developer’s session to install an infostealer from a poisoned PyPI package, harvest GitHub OAuth tokens, and deploy the self-propagating Shai-Hulud worm across about 100 internal code repositories. Mandiant says the actor then poisoned a package in the organization’s official namespace, which led to a second infection when another employee pulled it. Mandiant’s recommended controls include verification hooks that check AI-recommended dependencies against checksums and allow-lists, isolating local credentials from extensions, and restricting workstation egress. In a separate case in the same report, Mandiant says an attacker poisoned an internal AI repository and tampered with an assistant’s command-line hooks to run code through the assistant’s normal workflow.

On October 8, 2026, Socket reported that a release of the TensorLake npm SDK (version 0.5.144), used to build AI agent applications, had been compromised with a payload linked to the same worm family. Socket says the payload targets cloud and Kubernetes credentials, SSH keys and other secrets, as well as configuration and MCP files belonging to several AI development tools. It then republishes compromised versions of other packages tied to the victim’s publishing identity. Socket also warns that the payload watches its stolen GitHub token and is designed to wipe the user’s home directory if the token is revoked before its persistence is removed.

Why it matters to leaders (our analysis)

AI coding assistants run with a developer’s trust, credentials, and repository access, and developers tend to accept their suggestions. That makes a hijacked session an efficient way to get malicious code installed, and an assistant’s configuration and hook files both a source of secrets and a place to tamper. Neither is covered by controls that assume a human chose every package.

The response is mostly existing supply chain discipline applied to a new layer: approved dependency sources, short-lived scoped tokens, and endpoint monitoring that includes AI tool configuration. Leaders should ask which AI coding tools are in use and what each session can reach, because the answer is usually “everything the developer can.”