DIGGINGBEAGLE

Case · DiggingBeagle record

Hijacked AI coding-assistant session became the entry path for Shai-Hulud across about 100 repositories

Mandiant investigated an intrusion at an unnamed SaaS provider where an attacker hijacked a developer's active AI coding-assistant session. After an attacker-poisoned package was recommended and accepted, the chain led to an infostealer, stolen GitHub OAuth tokens, Shai-Hulud across roughly 100 internal repositories, repository-secret theft and source-code exfiltration.

Scope

Incident-response findings published by Mandiant. The victim SaaS provider, AI coding-assistant product, attacker identity, exact incident date and session-hijack mechanism are not identified in the cited public material.

Assessment profile

Assessment method
Setting
production
Exploitation
observed live
Evidence
Grade B
Basis and provenance

Mandiant's incident-response case study reports a hijacked developer session, accepted poisoned package, internal spread and exfiltration. observed_live refers to reported investigation evidence; victim identity, precise hijack path and wider downstream scope are unknown. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded.

Assessed Sep 24, 2026 using diggingbeagle.assessment/1.

Evidence basis: CLM-SHAI-HULUD-SPREAD · CLM-SECONDARY-INFECTION · CLM-SECRETS-SOURCE-EXFIL · CLM-ACTIVE-SESSION-HIJACK · CLM-POISONED-RECOMMENDATION · Mandiant AI Risk and Resilience Report 2026 - Case study 1

At a glance

Claims & evidence

CLM-SHAI-HULUD-SPREADAfter acceptance, Mandiant says the attacker used the active session to install an infostealer through a poisoned PyPI package, harvest GitHub OAuth tokens and deploy Shai-Hulud across approximately 100 internal code repositories.supported

Basis: reported finding

Link to claim
CLM-SECONDARY-INFECTIONThe attacker then poisoned a package inside the organization's official namespace, and another employee pulling the compromised version caused a secondary downstream infection.supported

Basis: reported finding

Link to claim
CLM-SECRETS-SOURCE-EXFILMandiant says the Shai-Hulud worm automated theft of repository secrets and programmatic exfiltration of proprietary product source code.supported

Basis: reported finding

Link to claim
CLM-ACTIVE-SESSION-HIJACKMandiant says a threat actor compromised an unnamed SaaS provider and hijacked an active AI coding-assistant session on a developer workstation.supported

Basis: reported finding

Link to claim
CLM-POISONED-RECOMMENDATIONThe hijacked assistant recommended installation of an external software package poisoned by the attacker; after the recommendation was accepted, the assistant's trusted workflow facilitated malicious software installation.supported

Basis: reported finding

Link to claim

Unknowns and contradictions

  • The affected SaaS provider is not publicly identified in the cited material.
  • The AI coding-assistant product is not publicly identified in the cited material.
  • The threat actor is not publicly attributed in the cited material.
  • The exact incident date is not stated in the cited public case study.
  • The method used to hijack the active assistant session is not disclosed.
  • The complete quantity of stolen repository secrets and proprietary source code is not stated.
  • The cited material does not establish whether additional downstream organizations were infected.

Sources and citation

EvidenceMandiant AI Risk and Resilience Report 2026 - Case study 1

Material revision history

  1. Sep 17, 2026 · Published version · first publication · revision 6
  2. Sep 17, 2026 · Published version · material revision · revision 9Public fields changed: links
  3. Oct 6, 2026 · Published version · material revision · revision 38Public fields changed: assessment_profile
Record metadata

Canonical ID: CASE-2026-MANDIANT-AI-ASSISTANT-SHAI-HULUD · revision 38