Field notes

SpecPilot Blog

Updates, guides, and insights on Specification-Driven Development.

3 min read

A Worm Hijacked an AI Coding Session and Spread Through 100 Repos. Your Agent Could Be Next.

Mandiant's new AI Risk and Resilience report documents a real attack where a hijacked coding-assistant session spread the Shai-Hulud worm across roughly 100 internal repos, plus a red team that walked an agent into leaking source code and a $50,000-in-an-hour runaway agent bill. None of it needed a jailbreak - just an agent with more trust than it should have had.

Read article

Be first to know what's changing in AI-assisted development

A weekly note on new tools, ways of working, and tutorials worth your time. No spam, leave any time.

Used only for this newsletter. See the privacy policy.