AI coding agents are changing how software gets built. They are also changing how attackers get in.
New research from CrowdStrike reveals a worm actively targeting AI infrastructure. It doesn’t break down the front door. It walks in because the system thinks it’s doing its job. The malware operates in what researchers call “blind spots.” These are areas where legitimate AI automation looks identical to malicious code.
The result is a tool that steals access credentials. It exfiltrates sensitive data. It even destroys target files. All while looking like routine development activity.
An Emerging Attack Class
This isn’t a hypothetical threat. This worm was found in the wild. Researchers uncovered it while investigating AI software supply chain attacks, as reported by WIRED.
Adam Meyers, CrowdStrike’s Senior Vice President of Counter Adversary Work, notes the company has not yet pinned this specific activity on one group. But it fits a pattern. Groups like TeamPCP (tracked as “Altered Spider”) and various North Korean actors are shifting tactics. They are targeting the AI toolchain itself.
“This is one of the campaigns that we’ve seen showing that this is an emerging attack,” Meyers told WIRED. “As AI coding agents become a standard in development, supply chain threats evolve to exploit those trust relationships.”
We are seeing the early stages of this. The AI toolchain is becoming a critical part of the tech ecosystem. Attackers know it. They are ready to abuse it.
The Worm’s Phase-by-Phase Attack
The malware doesn’t act all at once. It moves in phases.
- Reconnaissance. The worm first assesses the target environment. It maps what it sees.
- Credential Theft. It hunts for access tokens. It looks for cryptographic keys. It grabs server credentials.
- Privilege Escalation. As it gains deeper access, it unpacks more of itself. It targets “npm” tokens. These are critical for software package management. They also grant access to pull requests and other dev capabilities.
- Data Exfiltration & Destruction. The deeper it goes, the more data it can take. At the deepest level, it can activate a “death switch.” This feature destroys files or blocks legitimate users from the compromised infrastructure.
The goal is simple: maximize access and impact while minimizing detection.
Why Detection Fails: The Needle in the Needle Stack
The biggest problem with this worm is that it looks legitimate. So much of its behavior mimics standard AI operations.
“It’s like a needle in a haystack. Except this is a needle in a needle stack,” Meyers said.
Traditional security tools rely on telemetry to flag suspicious activity. In AI-driven pipelines, that data is messy. Legitimate AI coding systems generate similar signals. They run automation. They fetch packages. They execute code.
The worm does the same things.
“There is a lot of telemetry overlap,” Meyers explained. “It becomes very difficult to discern, from the telemetry you have, what is legitimate and what is illeg.”
The detection surface is limited. Not all activity produces a signal. When the signals that are produced look exactly like normal work, defenders are flying blind.
Time Delays and the Collateral Damage
To stay hidden, the authors of the worm added time delays. Capabilities don’t trigger immediately. They execute hours or days later. This breaks the direct cause-and-effect chain defenders use to trace attacks.
By the time the destructive phase activates, the initial entry point is long gone.
Meyers emphasizes that CrowdStrike is developing strategies to connect these dots. But the scale of the problem is growing. As AI software development explodes, the need for collaboration on structural solutions is urgent.
Current defenses are struggling. The tools used to build are being weaponized against those builders.
What This Means for Security Teams
This isn’t just a new virus. It’s a new class of supply chain threat. It exploits the trust we place in automation.
Organizations using AI coding agents need to rethink how they monitor their environments. Standard signatures won’t catch this. The behavior is the signature.
“It’s a limited detection surface… so it becomes extremely onerous to determine which behavior is legitimate.” — Adam Meyers, CrowdStrike
The question isn’t whether AI will be used for evil. It’s how quickly security can adapt to a landscape where the attacker looks like the employee.
For now, the worm sits in the blind spot. Waiting. Collecting. And waiting for the trigger.
Read More: OpenAI Models Escaped Containment | LastPass Data Breach | China’s Supercomputer LineShine
