AI coding tools are becoming valuable entry points for attackers seeking credentials, source code and access to connected systems. An analysis of 103 AI-linked cyber incidents found that trusted packages, coding assistants and IDE extensions were repeatedly abused in operational attacks.
Recorded Future’s Insikt Group published the findings on 11 November 2026. Rather than showing a surge in fully autonomous attacks, the report found criminals applying AI to familiar techniques such as supply chain compromise, credential theft, phishing, persistence and lateral movement.
AI coding tools among 103 AI-linked incidents
The analysis covered incidents observed between 31 July 2025 and 31 July 2026. Its central finding was that attackers generally exploited the privileged access surrounding AI coding tools, rather than attacking capabilities unique to artificial intelligence.
Developer tooling commonly connects to source repositories, cloud platforms, continuous integration systems and AI providers. It may store API keys, access tokens and environment variables. Compromising one package or extension can consequently provide access well beyond the developer’s workstation.
The incidents fell into several connected patterns:
- Compromised AI proxy packages that collected cloud credentials and developer tokens.
- Malicious IDE plugins presented as useful AI assistants.
- Self-propagating package campaigns that modified IDE and agent configuration files.
- Fake AI tool downloads that instructed users to execute malicious commands.
Subsequent incidents reported after the study period reinforce the same conclusion. These included another LiteLLM compromise in October 2026 and a malicious Claude Code branded extension analysed by Microsoft on 30 October 2026.
LiteLLM supply chain compromises stole secrets
LiteLLM, a proxy used to connect applications with multiple large language model providers, was compromised through malicious PyPI releases in March 2026. The affected versions were reported as 1.82.7 and 1.82.8.
The malicious code could execute when the package was imported or during environment setup. It collected environment variables, cloud credentials and developer tokens, while additional backdoor functionality supported persistence and movement into connected environments.
Analysts traced the intrusion chain to poisoning of upstream continuous integration artefacts in late March. The campaign was widely linked to TeamPCP, an actor also associated with the Mini Shai-Hulud supply chain activity.
A separate LiteLLM compromise affecting version 1.107.0 was disclosed on 21 October 2026. That release was distributed through PyPI wheels and delivered an information stealer and backdoor. At the time of disclosure, no link had been established between the October incident and the March campaign.
Estimates of LiteLLM exposure vary because some are based on package downloads or security telemetry rather than confirmed payload execution. Organisations should therefore use their own package, download and execution records to determine whether a malicious release actually ran.
Malicious plugins targeted AI provider keys
Attackers also disguised malicious extensions as AI coding tools. JetBrains confirmed that 15 third party Marketplace plugins had been designed to steal OpenAI and other provider API keys.
The plugins were active between October 2025 and June 2026. JetBrains removed them and disabled installed copies on 17 June 2026, then advised affected users to revoke and rotate every AI API key entered into the plugins.
When a developer saved the plugin configuration, the entered keys were transmitted in plaintext over HTTP to a hardcoded address at 39.107.60.51. The plugins also injected a TrustManager designed to suppress TLS warnings, reducing the chance that developers would notice suspicious communications.
Other marketplaces faced similar abuse. On 10 August 2026, malicious VS Code extensions using the name solidity-pro were reported stealing cryptocurrency wallets and developer credentials under multiple publisher identities.
On 29 and 30 October 2026, versions 2.1.312 and 2.1.313 of a malicious Claude Code branded extension were briefly distributed through the Cursor marketplace. Microsoft published technical analysis, indicators and hunting guidance on 30 October. The incident demonstrated how branding associated with established AI coding tools can make an extension appear trustworthy.
Mini Shai-Hulud persisted through project files
The self-propagating Mini Shai-Hulud campaign added another risk: malicious behaviour could survive the removal of an infected package. Reports of a worm stealing developer tokens and secrets emerged on 22 April 2026, before a larger wave peaked on 11 May.
The worm stole npm and GitHub tokens and used them to publish malicious updates, helping it spread through trusted developer ecosystems. It also modified configuration files used by VS Code and Claude Code.
In VS Code projects, the malware added tasks to .vscode/tasks.json and set runOn to folderOpen. This caused the payload to run when somebody opened the affected project. For Claude Code, it created unexpected SessionStart hooks in .claude/settings.json, sometimes referencing .claude/setup.mjs.
These changes provided persistence outside the originally compromised dependency. Opening a project or starting a Claude Code session could silently execute the malware again, even after the affected package had been removed.
Fake AI coding tools delivered PowerShell stealers
Attackers also exploited demand for AI coding tools through fake installer pages. Between 3 and 5 June 2026, researchers publicised Google Sites pages impersonating Claude Code and Codex downloads.
The pages used a ClickFix-style technique, telling visitors to copy and run an mshta command. That command launched a staged PowerShell chain using in-memory execution and steganographic payloads. The final malware targeted saved browser passwords, email credentials and cryptocurrency wallet data.
This was not a vulnerability in Claude Code itself. The attack depended on convincing users that manual command execution was a legitimate installation step. Search poisoning and convincing product branding helped bring potential victims to the fraudulent pages.
Current exploitation status and organisational impact
These were active campaigns, not laboratory proofs of concept. In-the-wild exploitation is confirmed for both LiteLLM compromises, the malicious JetBrains and Cursor extensions, Mini Shai-Hulud and fake Claude Code installers.
The 103-incident analysis matters because AI coding tools often sit close to valuable credentials and production systems. A stolen provider key can create unauthorised costs or expose prompts and data, while repository and cloud tokens can support wider compromise.
Actions for affected development teams
Organisations should first determine whether the named versions, plugins or configuration changes appear in their environments. The response should focus on the specific access these incidents could have exposed.
- Remove LiteLLM versions 1.82.7, 1.82.8 and 1.107.0, then inspect installation and execution logs.
- Revoke AI provider, cloud, npm and GitHub tokens stored on potentially affected systems.
- Block and investigate communications with 39.107.60.51.
- Review .vscode/tasks.json for unexpected folderOpen tasks and .claude/settings.json for unknown SessionStart hooks.
- Audit IDE extensions by publisher, version and installation source, including automatically disabled plugins.
- Use Microsoft’s published indicators and hunting guidance for the October Cursor extension incident.
Credential rotation should follow investigation of persistence. Replacing keys without removing malicious hooks, extensions or backdoors could allow attackers to capture the new credentials as soon as they are used.
Originally reported by cybersecuritynews.com.
