According to the report, the initial foothold came through the assistant itself: before the repository spread occurred, the AI coding assistant recommended software that the attacker had poisoned, and that recommendation was accepted. The malicious software then enabled the worm to steal repository secrets and source code.

Key points from the findings:

• An active AI coding-assistant session was hijacked at the targeted SaaS provider.
• The assistant surfaced a recommendation for attacker-poisoned software, which was accepted.
• The Shai-Hulud worm subsequently spread to approximately 100 internal repositories.
• Repository secrets and source code were stolen in the campaign.

The incident highlights how trusted developer tooling, including AI assistants, can become an initial access vector when their recommendations are manipulated. Organizations relying on AI-assisted development should scrutinize suggested dependencies and packages before adoption, and monitor repositories for unusual activity that could indicate worm-like propagation.

Source: The Hacker News

Does your organization review AI assistant code or package recommendations before they are adopted?