Mandiant reports that an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider. The attacker then used that foothold to spread a tool called Shai-Hulud across roughly 100 internal code repositories, according to the firm's analysis.
Before the repository-wide infection, the compromised assistant recommended software that the attacker had apparently influenced. That detail suggests the hijacked session was used not just for direct access, but to manipulate the assistant's output as part of the attack chain.
The incident illustrates a growing risk: AI coding assistants, which developers increasingly trust with software recommendations, can become a channel for supply-chain compromise when their sessions are hijacked. The report is based on a single vendor's investigation, so independent confirmation is not yet available.