2026-09-17 AI 与数据工作流雷达
来源：The Hacker News。这里只保留与 AI 编程、数据/研究工作流、安全边界或可信工程直接相关的高信号线索；不抓取全文，也不代表事实核验或产品推荐。
Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories
主题：AI 编程与开发工具 / AI 与数据安全
来源日期：2026-09-16
相关性分数：8
候选状态：待评估
为什么值得看：命中与临床统计、研究工程或可信 AI 工作流直接相关的高信号主题；仍需阅读全文并回到官方文档、原始研究或供应商公告交叉核验。
Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100 internal code repositories. Before the repository spread, the assistant recommended software that the attacker had poisoned, and the recommendation was accepted. The worm stole repository secrets and source code for the company’s products. The case appears in Mandiant’s September 2026 report . The public case study does not say when the intrusion happened or how the attacker took over the active coding-assistant session. How the Attack Unfolded After the recommendation was accepted, the attacker used the developer’s active session to install an infostealer through a poisoned PyPI package. The attacker also stole GitHub OAuth tokens. The attacker then deployed the self-spreading Shai-Hulud worm across approximately 100 internal code repositories. The attacker also poisoned a package in the company…
可转化方向：评估是否能转化为临床编程、代码审查、测试或自动化实践；评估 AI 辅助研究和编程中的隐私、凭据、供应链与安全边界
AI Security’s Greatest Hits
主题：AI 与数据安全
来源日期：未提供
相关性分数：3
候选状态：待评估
为什么值得看：命中与临床统计、研究工程或可信 AI 工作流直接相关的高信号主题；仍需阅读全文并回到官方文档、原始研究或供应商公告交叉核验。
Get 7 of the most widely used AI security resources in one pack. Each asset provides practical tools for securing AI apps, models, and agents.
可转化方向：评估 AI 辅助研究和编程中的隐私、凭据、供应链与安全边界