Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories

An attacker took control of an AI coding assistant session at a software-as-a-service provider and used it to spread malware called Shai-Hulud to around 100 internal code repositories. The attacker first poisoned software recommendations made by the assistant, which were then accepted. The malware, a worm, stole secrets and source code from the repositories. The incident involved the hijacking of an active session, allowing the attacker to carry out these malicious activities. The attacker's actions were facilitated by the acceptance of the tainted recommendations. The stolen information included repository secrets and source code.