An attacker hijacked an AI coding assistant to spread a worm

Assessment

Mandiant confirms an attacker took over a developer's active AI coding-assistant session and that the assistant recommended attacker-poisoned software, which the developer accepted — leading to an infostealer installed via a poisoned PyPI package, GitHub OAuth token theft, and the Shai-Hulud worm spreading across about 100 internal repositories. But Mandiant's public case study explicitly does not say how the attacker took over the active session, and the documented AI role was recommending a poisoned dependency that a human accepted — a human-in-the-loop supply-chain acceptance, not a demonstrated compromise of the AI model or the assistant software itself. Framing this as 'the AI assistant was hacked' overstates what Mandiant disclosed; the mechanism of the session takeover remains unknown, and the more precise description is a poisoned AI-recommended dependency that a developer approved.