Attacker hijacks AI coding assistant session and spreads Shai-Hulud across about 100 repositories

Sep 16, 2026 · Issue 7 · 3 sources, 3 articles

An attacker took over an AI coding assistant session and spread the Shai-Hulud malware across roughly 100 repositories. The Hacker News reported the incident on 16 September.

Who is affected and how

senior developer

Narrowly scoped credentials should be used to guard against leaks of agent session tokens and repository permissions.

Narrative: The coding agent is the new attack surface

Sources

• Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositoriesthehackernews.com · Sep 16, 2026
• Shai-Hulud Worm Attack: AI Coding Assistant Session Hijack Exposes SaaS Code Repositories to Supply Chain Compromiserescana · Sep 17, 2026
• Mandiant Details AI Coding-Assistant Session Hijack and Shai-Hulud…letsdatascience.com · Sep 18, 2026

Machine-generated summary based on the titles and excerpts of the source articles. The facts come from the linked article.