The Assistant Was Still Trusted. The Authority Behind It Had Changed.

A trusted interface can remain visually unchanged even after the authority behind its recommendations has been replaced.

Mandiant’s 2026 AI Risk and Resilience report describes a production intrusion in which a threat actor compromised a software-as-a-service provider and hijacked an active AI coding-assistant session on a developer workstation. The assistant, operating as a trusted interpreter in the environment, recommended installation of an external package that had been poisoned by the attacker.

After the recommendation was accepted, the attacker used the developer’s active session to install an infostealer through a poisoned PyPI package, harvest GitHub OAuth tokens, and deploy the self-propagating Shai-Hulud worm across approximately 100 internal code repositories. Mandiant reports that repository secrets and proprietary source code were stolen, and that poisoning of the organization’s own package namespace caused a secondary downstream infection.

The visible identity stayed the same

From the developer’s perspective, the recommendation came through the same coding assistant and the same active work session. The interface preserved continuity of appearance.

The causal chain, however, had changed.

Expected: Developer task → trusted assistant → package recommendation → install.

Actual: Attacker → hijacked assistant context → apparently trusted recommendation → install.

Authority can be laundered through a trusted session

GovKM maps this as a break in Authority → Context → Decision. The assistant still possessed legitimate technical capability and occupied a trusted position, but the authority shaping its recommendation was no longer the developer’s.

This is a form of authority laundering: malicious causation is transformed into an apparently legitimate recommendation because the trusted intermediary remains recognizable.

Recommendations need provenance

An AI recommendation should not be trusted solely because it came from an approved tool. For consequential actions, the institution needs enough lineage to establish which instructions shaped the recommendation, which source produced the dependency, whether that source remained trustworthy, and what authority justified executing it.

GovKM interprets the incident as strong evidence that session identity is not instruction lineage.

Source

Google Cloud / Mandiant, “Mandiant AI Risk and Resilience Report 2026,” September 2026, Case Study 1: “Weaponizing active developer AI sessions to deploy the Shai-Hulud worm.” https://cloud.google.com/security/resources/ai-risk-and-resilience-2026