> TritonInfoSec News
Home / Sep 17, 2026 / Story
0
#1 The Hacker News general September 16, 2026 at 13:37 UTC

Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories

By [email protected] (The Hacker News)

AI Summary

Mandiant documented a case where an attacker hijacked an active AI coding-assistant session at an unnamed SaaS provider, used it to recommend poisoned software packages, then spread the Shai-Hulud worm across approximately 100 internal code repositories, stealing secrets and source code. This represents a novel supply-chain attack vector where AI coding assistants become both the initial access vector and the propagation mechanism, a significant concern for organizations that have integrated AI pair programmers into development workflows.

Read full article → https://thehackernews.com/2026/09/attacker-hijacks…

Relevance score: 88.0/100

# More from September 17

  1. 2
    Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens The Hacker News
  2. 3
    Google Patches Pixel Modem Flaw Amid Signs of Limited Targeted Exploitation The Hacker News
  3. 4
    One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude The Hacker News
  4. 5
    Critical ScreenConnect flaw now actively exploited in attacks BleepingComputer
  5. 6
    Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks The Hacker News
  6. 7
    Iranian hackers use CHOSEN BRICK Windows malware to spy on targets BleepingComputer
  7. 8
    Chrome, Firefox Updates Patch 115 Vulnerabilities SecurityWeek
  8. 9
    Texas Utility CenterPoint Energy Confirms Breach After Hacker Leaks Data SecurityWeek
  9. 10
    Oracle Patches 800+ Vulnerabilities in September 2026 Security Update SecurityWeek