The report
Mandiant has documented an incident where an attacker turned a trusted AI coding-assistant session into a software supply-chain entry point.
In the case study, an unnamed SaaS provider was compromised and an active AI coding-assistant session on a developer workstation was hijacked. Mandiant says the assistant then recommended an external software package poisoned by the attacker. The recommendation was accepted.
The attacker subsequently used the active session to install an infostealer through a poisoned PyPI package, harvest GitHub OAuth tokens and deploy the self-propagating Shai-Hulud worm across approximately 100 internal code repositories. Mandiant says the worm automated repository-secret theft and exfiltration of proprietary product source code.
The chain did not stop at the first workstation. The attacker poisoned a package inside the victim organization's own official namespace, and another employee became infected after pulling the compromised version.
The public case study does not identify the victim, the coding assistant, the attacker or the method used to hijack the active assistant session. A fresh Reddit discussion speculated that stolen tokens or session cookies might explain the takeover, but that mechanism is not established by Mandiant.
The practical security boundary is therefore narrower and stronger than the speculation: an already-trusted developer AI session can become part of the execution and dependency path, so assistant sessions, reachable credentials and AI-recommended dependencies need to be treated as privileged software-supply-chain surfaces.