Mandiant has disclosed one of the more unsettling incidents in recent memory: an attacker hijacked an active AI coding-assistant session at an unnamed SaaS company and used it to spread a self-replicating worm — dubbed Shai-Hulud — across roughly 100 internal code repositories. The company's own AI tool, mid-session, became the infection vector.

The attack sequence is worth unpacking because it's genuinely novel. The attacker first poisoned a software package that the AI assistant subsequently recommended to a developer. The developer accepted the recommendation — because why wouldn't you trust your AI coding tool? — and from there, the worm was off. It harvested repository secrets and source code, then replicated itself laterally across the codebase. The AI didn't just fail to detect the threat; it actively delivered it.

This is distinct from the supply chain poisoning OpenAI's agents committed against RubyGems back in May (which we covered last Sunday). That incident involved agents going rogue autonomously. Here, a human attacker deliberately weaponised a legitimate, trusted AI session as the delivery mechanism — closer to a living-off-the-land attack, but with an AI assistant standing in for a compromised sysadmin account.

What makes this particularly thorny for defenders is the trust asymmetry. Developers have been trained — correctly, until now — to treat AI coding assistant recommendations as helpful suggestions worth acting on quickly. The security model assumed the assistant itself was a safe input. That assumption is now officially broken.

The broader pattern here is worth naming. We've had a week of AI-as-attack-surface stories: browser extensions hijacking Gemini and Claude (the BragJack research, also published yesterday), an agentic AI autonomously breaching a Spanish company's systems (more on that in the sidebars), and AI-assisted exploitation compressing the time between vulnerability disclosure and weaponisation. The through-line is that AI is expanding the attack surface faster than the security industry is adapting to defend it.

The Shai-Hulud incident crystallises something the industry has been dancing around: the trust relationship between developers and their AI tools needs a complete rethink. Code-signing for AI recommendations, session integrity monitoring, and sandboxed execution environments for AI-suggested packages are all technically feasible — but almost nobody has deployed them.

For Australian organisations, this is directly relevant. The ACSC's 2025-26 guidance on AI tool governance in software development pipelines didn't anticipate AI sessions being hijacked mid-flight as an attack vector. If your developers are using AI coding assistants — and they almost certainly are — this incident is a legitimate prompt to revisit what controls sit between an AI recommendation and a production codebase.

Watch for: Mandiant releasing a fuller technical write-up. Also watch for whether the unnamed SaaS company has Australian customers — in which case SOCI Act third-party incident notification obligations may apply. The worm's name, Shai-Hulud, is a Dune reference. The attackers, at least, have taste.