A Hijacked Coding Assistant Seeded a Worm Across 100 Repositories. Mandiant Says the Model Was Not the Flaw

Google's Mandiant has published AI Risk and Resilience, a special report built not from a survey but from cases its consultants, red teamers and the Google Threat Intelligence Group worked through during 2026. The most striking entry in it is this: at a software-as-a-service provider, an attacker took over an active AI coding-assistant session, used it to recommend a poisoned PyPI package, and seeded the self-spreading Shai-Hulud worm across roughly 100 internal repositories. GitHub OAuth tokens, repository secrets and the company's own product source code went out the door.

Nothing in that account requires the model to have been tricked into misbehaving. The assistant recommended a dependency, which is what it is for. A developer took the recommendation, which is what developers do. The compromise was of the session and the supply chain around it — and the agent's privileges turned a single foothold into a hundred repositories.

The agent is an identity now

That is the argument running through the whole report, and it is a more useful one than the usual framing about AI-powered attackers. Enterprises spent 2026 moving from assistants that suggest to agents that execute: systems that hold tokens, call APIs, write to repositories, change production configuration and spend money. Mandiant's phrasing is precise.

In these scenarios, the LLM is a participant rather than an advisor and enables pivoting and decision-making at machine-speed.

A participant with credentials is an identity, and identities are attacked the way identities have always been attacked. Several of the documented cases land in exactly that place. A prompt-injection attack on a CI/CD assistant confused it about whose instructions it was following and walked internal repositories out to an external endpoint. Another intrusion poisoned an internal AI repository and tampered with CLI hooks to get code execution through the platform's ordinary workflow. A customer-service agent drawing on a community forum was steered by comments planted in the forum itself.

None of these are exotic model-theory failures. They are missing authorization checks, unsegmented credentials and untrusted input reaching a privileged process — old problems, inherited by a component that has more access than the thing it replaced.

The case with no attacker in it

One entry has no adversary at all. An accounting reconciliation agent fell into an unconstrained reasoning loop and made more than 15,000 high-cost API calls in under an hour, producing a cloud bill of roughly $50,000 and locking a database hard enough to disrupt live business transactions.

Mandiant files this as denial-of-wallet, and it belongs in a security report for a reason. An autonomous system with a budget and no circuit breaker is an availability risk and a financial one whether or not anyone is aiming it. Most organisations have spending alerts that fire well after a runaway agent has finished spending.

What the adversary side actually did

The report's threat-intelligence half is more incremental, which is itself worth noting. Attackers moved from prompting models for help to running them inside autonomous offensive frameworks — Hexstrike and Strix are named — for reconnaissance, vulnerability validation and credential harvesting. Some malware now ships a small embedded model to mutate its own payloads at runtime and evade signature-based detection. In February, VirusTotal found malicious OpenClaw agent skills dressed up as ordinary automation packages, carrying backdoors and infostealers. In May came the first publicly confirmed criminal use of an AI-developed zero-day in mass exploitation, a two-factor bypass in an open-source web administration tool.

Set against that, one finding stays constant: exploitation of vulnerabilities remained the leading initial infection vector for the sixth consecutive year. The machinery got faster. The way in did not change.

What to do about it

Mandiant's recommendations are unglamorous and mostly about plumbing:

The report's own conclusion is the line worth keeping: "Resilience in 2026 is defined in part, by how effectively an enterprise governs and secures non-deterministic AI systems at scale."

The practical reading for anyone running these tools is narrower than that. Every AI agent deployed this year was granted access on the assumption that it is a tool. Mandiant's casebook is a hundred repositories' worth of evidence that it should have been enrolled as a user — one that never sleeps, reads whatever it is pointed at, and holds a token.

Sources: Mandiant AI Risk and Resilience Report 2026, Google Cloud · The Hacker News: Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories · Help Net Security: One runaway AI agent racked up a $50,000 cloud bill · Sonar: Mini Shai-Hulud Targets AI Coding Agents