ACVEAgent configuration vulnerability registry

Advisories › ACVE-2026-0539

ACVE-2026-0539

An attacker hijacked a developer's AI coding-assistant session, which recommended a poisoned package; the attacker then stole tokens and spread the Shai-Hulud worm across about 100 repositories.

Exposure

Evidence
Real use · researcher report
Harness
An unnamed AI coding assistant in an active session on a developer's workstation — confirmed, cloud.google.com
Model
any; product and model not stated — unconfirmed, thehackernews.com
Goal
Any ordinary development task in a repository with dependency and secret access (goal not stated by the source) — detected, thehackernews.com
Tools and settings
The developer's active assistant session, used to install an infostealer through a poisoned PyPI package and harvest GitHub OAuth tokens — confirmed, cloud.google.com
Approval
The assistant's recommendation to install the poisoned package was accepted; the report does not say by whom or in what approval mode — confirmed, cloud.google.com
Input controlled by
unknown
What the agent does
The hijacked assistant recommends and executes the installation of a poisoned external package, which the attacker uses to steal tokens and deploy a worm.
Harm
data-exfiltration
Reach
About 100 internal code repositories with their secrets and source code, GitHub OAuth tokens, and a package in the organisation's official namespace that infected another employee — confirmed, cloud.google.com (private repositories, API keys)
Condition
When a threat actor who had compromised a SaaS provider hijacked an active AI coding-assistant session on a developer's workstation — confirmed, cloud.google.com
Scale
Approximately 100 internal code repositories were affected — 100 repositories, cloud.google.com
Recovery
Not reported: Mandiant's case study does not say whether the compromise was contained, the tokens revoked or the repositories cleaned. — unconfirmed (unknown)
First-hand sources

Reproducibility: partial (model availability not checked (no registry reference); trigger not published)

Severity
HIGH · harm and reach
Status
Unverified
Kind
Behavioural
Modified
2026-09-25
Aliases
No CVE assigned — No code defect is established: the harm arose from an attacker-controlled coding session and poisoned dependency.
Affected
  • AgentHarness: unnamed-coding-assistant — all versions
Harness/product
unnamed-coding-assistant
Classes
supply-chain; credential-exposure; data-exfiltration; CWE-522; CWE-359
First reported
2026-09-16 — Mandiant (Google Threat Intelligence Group)
Licence
CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

The exposure axes marked confirmed were matched to the first-hand sources listed above.

Description

Threat

user · supply-chain · exfiltration

What

In a case study in its September 2026 AI risk and resilience report, Mandiant says a threat actor compromised a SaaS provider and hijacked an active AI coding-assistant session on a developer's workstation. The assistant recommended installing an external package the attacker had poisoned, and by executing that recommendation it helped install the malicious software. Through the developer's session the attacker then installed an infostealer via a poisoned PyPI package, harvested GitHub OAuth tokens and deployed the self-propagating Shai-Hulud worm across about 100 internal code repositories, stealing repository secrets and proprietary source code. The attacker also poisoned a package in the organisation's official namespace, which infected another employee who pulled it. The assistant's product and model are not named.

Detection

The case study does not state when or how the session was hijacked, or whether the compromise was contained. Recorded from Mandiant's report. Not recreated in a lab.

Fix

Keep secrets and long-lived tokens out of direct agent reach, verify agent-recommended dependencies, and route dependencies through controlled repositories.

Fix

Protect secrets and verify dependencies recommended by coding agents.

  • Reconfigure agent.approval to ask. Dependency installation and repository-wide actions need review. Owner: operator
  • Reconfigure coding-assistant.credentials to local credentials kept out of the assistant extension's reach. Recommended: Mandiant advises it after the hijacked session harvested GitHub OAuth tokens. Owner: harness-vendor

References

REPORT

ARTICLE

Report a problemJSON