Session Hijack and Lateral Movement
On September 16, 2026, security researchers disclosed a sophisticated supply chain attack targeting an unnamed software-as-a-service (SaaS) provider. The attacker successfully hijacked the active session credentials of an AI coding assistant, allowing them to bypass traditional authentication barriers and gain broad access to internal code repositories. According to Rescana, the incident highlights a critical vulnerability in non-human identity (NHI) governance, as the AI agent possessed persistent, overly permissive credentials that lacked behavioral monitoring.
Once the session was compromised, the attacker leveraged the AI’s capabilities to suggest and install a malicious PyPI package. This package served as the delivery vehicle for the Shai-Hulud worm, which subsequently propagated across approximately 100 internal repositories. The worm did not require privilege escalation; it simply utilized the existing, high-level permissions already granted to the AI assistant.
Persistence and Data Exfiltration
The Shai-Hulud worm achieved persistence by injecting malicious hooks into configuration directories for AI tools and code editors. Specifically, it modified .claude/settings.json for Claude Code and .vscode/tasks.json for Visual Studio Code, ensuring that malicious scripts executed whenever a project was opened. This mechanism allowed the worm to spread laterally between repositories on the same machine.
The malware’s payload included a bootstrapper that downloaded Bun 1.3.14 to facilitate a comprehensive credential harvest. The worm scanned for over 80 environment variables and 130 file paths, exfiltrating sensitive API keys, OAuth tokens, and source code to a command-and-control (C2) server disguised as an OpenTelemetry endpoint. Reports from The Hacker News and IT-Learn.io confirm that the incident relied on the absence of monitoring for anomalous agent behavior, such as rapid, automated modifications across multiple codebases.
Mitigation and Future Security
Organizations are advised to treat AI agent sessions as high-value, privileged identities. Immediate remediation steps include auditing .claude/ and .vscode/ directories for unauthorized hooks, rotating exposed service account credentials, and applying strict least-privilege scoping to all AI-driven development tools. Implementing behavioral monitoring to detect rapid cross-repo modifications is considered a high-priority safeguard against similar supply chain compromises.