Mandiant: hijacked AI coding session spread Shai-Hulud worm across ~100 repos

Mandiant reported that an attacker hijacked an AI coding-assistant session and used it to spread the Shai-Hulud worm across roughly 100 internal repositories at a SaaS provider. It is the first sourced case of agentic coding tools acting as a live supply-chain attack vector.

• Shai-Hulud worm spread across ~100 internal repos at a SaaS provider
• Attack ran through a hijacked, developer-trusted AI coding session
• Temporal raised $550M Series E at a $12.55B valuation
• Factory raised $200M, tripling its valuation to $5B in five months