Business It News / Business Intelligence
Attackers turn AI coding tools and agent skills into supply-chain entry points
AI assistants, agent skills and open–chain targets for cybercriminals, according to new frontline research from Mandiant
The Google Cloud security business warned that the rapid integration of AI into software development was giving attackers new opportunities to disguise malware as useful automation packages, manipulate coding assistants and compromise trusted development workflows.
Mandiant’s AI Risk and Resilience report detailed an attack in which a threat actor compromised a software-as-a-service provider and hijacked an active AI coding assistant session on a developer workstation.
The assistant recommended installing an external software package that had already been poisoned by the attacker. Once the recommendation was accepted, the compromised package installed an information stealer, harvested GitHub OAuth tokens and spread the Shai-Hulud worm across approximately 100 internal code repositories.
The worm automated the theft of repository secrets and exfiltration of proprietarye organisation’s official namespace, causing another employee to become infected after downloading the compromised version
The case demonstrated how an AI assistant operating as a trusted interpreter between a developer and their environment could inadvertently become a Trojan horse.
Attackers are also targeting the growing ecosystem of reusable AI agent skills.
VirusTotal researchers observed the weaponisation of OpenClaw AI agent skills in February, with backdoors, droppers, information stealers and remote-access tools distributed as apparently legitimate automation packages.
The following month, Mandiant responded to multiple supply-chain compromises associated with the threat actor UNC6780, also known as TeamPCP.
The group used more than half a dozen techniques to exploit AI tools and open-nts and large language model security scanners through prompt injection. The attackers also stole credentials for AI services and proprietary AI data
In another incident, an attacker poisoned an internal AI repository and tampered with the underlying command-line hooks used by an assistant. This allowed the actor to achieve remote code execution through what appeared to be the AI platform’s normal operational workflow.
Mandiant said organisations should treat AI coding assistants, local plugins and Model Context Protocol servers as privileged development components rather than low-risk productivity tools.
Recommended controls included digitally signing and verifying AI assistant binaries, command-line helpers, plugins and MCP servers before they could execute. Changes to internal agent skills and hooks should also be subject to strict code reviews, access controls and multi-party approval.
The report advised organisations to prevent extensions from directly accessing raw API keys, long-lived OAuth tokens and other secrets. AI-recommended software dependencies should be checked against approved lists and cryptographic hashes, while dependency downloads should be routed through controlled internal repositories.
Mandiant also called for a real-time inventory of AI applications, models and endpoints, supported by automated software bills of materials covering every build.
Open-weight models created a related set of challenges because responsibility for checking model provenance, training data, architecture and components might fall largely on the organisation deploying them.
The report recommended cryptographic verification, bias testing, vulnerability assessments and continuous monitoring for model drift.
As AI becomes part of the development toolchain, Mandiant said established secure software development practices would need to be extended across models, agent skills, data pipelines and runtime infrastructure. Knowing precisely which AI components are operating—and verifying their chain of custody from code to production—would be critical to reducing the next generation of software supply-chain risk.
