Poisoned Pipeline / Incidents / AS27
Hijacked AI coding assistant spreads Shai-Hulud
PyPIGit / GitHubAI coding agentsVS Code / IDEDeveloper workstation
Mandiant's AI Risk and Resilience 2026 report (case study 1) describes an
IR where an attacker hijacked an active AI coding-assistant session. The
assistant recommended attacker-poisoned software; the human accepted; the
same session installed an infostealer via PyPI, stole GitHub OAuth tokens,
and deployed Shai-Hulud across about 100 internal repositories. The actor
then poisoned a package in the company's official namespace, which a
second employee pulled.
Mapped techniques
- T0152 IDE
- T0210 Poison AI coding-agent config or workspace
- T0109 Publish malicious artifact
- T0151 Installation scripts
- T0112 Compromised token
- T0169 Push implants across repositories
- T0200 Proprietary data stolen
- T0121 Compromised legitimate artifact
supply-chain AI coding-assistant session
The live assistant session was the install oracle.
Hijacked session recommended and then installed poisoned software.
Poisoned PyPI package plus later official-namespace poison.
Infostealer ran from the accepted PyPI install.
GitHub OAuth tokens stolen from the developer environment.
Shai-Hulud spread across about 100 internal repositories.
Secrets and product source were taken from those repos.
A package in the company's official namespace was then poisoned.
Framework gaps noted
- AI-recommended dependencies have no lockfile and no first-class technique beyond T0210/T0152.