A SaaS shop is rotating repository secrets and hunting stolen source because an engineer accepted a software recommendation from an AI coding assistant. Mandiant says the attacker hijacked that live session, poisoned the suggestion, then pushed the Shai-Hulud worm across about 100 internal repositories. Your cybersecurity program likely still files the assistant under developer experience. The worm filed it under trusted install.

The session was already authenticated. The package name looked plausible. Edge threat-protection that watches for brute-force noise against git or SSH never saw a failed login. The firewall never got a deny to log. Defense in depth that only scores the perimeter will call this a clean hour.

Treat the assistant as a production access path. It sits next to the repo, the CI token, and the cloud key the developer already has loaded. A hijacked chat is a privileged console with a friendly tone.

A Trusted Prompt Became the Installer

Mandiant’s unnamed victim is a software-as-a-service provider. Those roughly 100 internal repositories were the product, plus the secrets that ship it. Cleanup now means secret rotation, source-exposure analysis, and a rebuild of whatever CI accepted the poisoned package.

The assistant recommended software the attacker had poisoned, and someone accepted it. Shai-Hulud then spread through about 100 internal repositories and stole secrets and source.

This is a bad look for every shop that rolled out coding copilots as a default IDE plugin with org-wide tokens and no session audit. You gave a network-connected agent the right to suggest installs, and you trained people to say yes quickly. Attackers noticed.

The same social pattern is running outside the IDE. Unit 42 is tracking Atomic macOS stealer activity that uses deceptive setup guides to harvest credentials and sensitive files. Bruce Schneier flagged a fake CAPTCHA variant that borrows the prove you are human frame so a user downloads and runs a malicious program. Different wrappers. Identical move: a trusted helper tells you what to execute, and you execute it.

Threat detection that waits for a known malware hash on a laptop will miss the hour where the only payload is a package the assistant named. Your endpoint stack might catch AMOS after the setup-guide click. It still misses a dependency that CI just built because a chat pane said it was fine.

Developers are using assistants. The operational question is whether the suggestion stream is logged, scoped, and treated as a change-control event.

Trusting the Assistant Bypasses Your Cybersecurity Stack

Cisco Talos is blunt about the next few years. AI will keep finding vulnerabilities that are painful or effectively impossible to patch on a useful clock. You will not update the copilot fast enough to erase this class of abuse. Compensating controls are the job. Segmentation, real visibility, and inspection in front of what the assistant can reach beat hoping the model stays harmless.

Security hardening for coding assistants is mostly blast-radius work. Do the urgent cuts this week. Keep the logging and allowlists. That is basic cyber security hygiene for a privileged client.

• Immediately revoke and rotate every repository, CI, cloud, and package-registry secret that sat in the same identity context as the hijacked session. Assume source from the affected repos is already in the attacker’s hands.
• Immediately disable auto-apply or one-click install from assistant suggestions. Require a second channel such as lockfile review, an allowlisted registry, or a signed artifact before a new dependency hits CI.
• Immediately inventory which assistants, IDE plugins, and tool bridges have network and repo access. Kill org-wide tokens. Issue short-lived, repo-scoped credentials that cannot push to 100 repositories from one chat.
• On an ongoing basis, log prompt and suggestion metadata into your incident response pipeline the way you log admin command history. Hunt for an accepted suggestion that CI then built, and treat that chain as a first-class detection.
• Keep edge lockouts for SSH and git brute-force. Tools such as ipban still belong on those listeners, and IPBan Pro is a reasonable upgrade if you already live in that niche. Pair that with allowlisted package sources and segmented build networks so a poisoned suggestion cannot walk into prod.

Put the build fleet and package caches on a network the assistant cannot reach directly. If the model can only propose a name, and a detached, allowlisted builder is the only process that can fetch it, you removed the accepted-suggestion fast path. That is defense in depth you can explain to a CFO without a vendor slide.

Talos points at next-gen inspection and IPS as a compensatory layer for unpatchable bugs. Apply that idea to the assistant’s egress. If the chat host can phone home to arbitrary package indexes, you volunteered for this worm.

Stolen Secrets Outlive the Session You Kill

Incident response begins with the stolen secrets and the copied source. Those survive the process tree. They show up later as a push to a personal fork, a cloud key in someone else’s CLI, or a quiet dependency on a package you do not ship.

Start the investigation at the chat transcript and the identity that accepted the install. Then walk CI, artifact stores, and every downstream system that identity could touch. Clone-and-grep on the 100 repos will miss the token that already left.

Rehearse this with your IR team as a tabletop that starts at a developer saying yes to a suggestion. Assign owners for secret revocation, package allowlists, and assistant-session audit. If nobody owns the prompt log, you lack threat detection for this path.

You cannot patch human trust in a helpful pane. You can make that pane a low-privilege, well-logged, segmented client. Do that before the next poisoned recommendation lands with your on-call.

Sources

• Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories
• Securing the unpatchable in an age of AI-driven vulnerabilities
• Atomic macOS (AMOS) Stealer Activity
• Fake CAPTCHA Scams