As AI tools proliferate and become deeply ingrained in software development around the world, new research from the cybersecurity firm Crowdstrike shows how attackers are actively targeting the AI toolchain to steal access credentials, gain deeper access to a target environment, exfiltrate sensitive data, and even destroy target files and systems—all while finding new ways to cover their tracks.
Researchers discovered a worm in the wild while investigating AI software supply chain attacks. Adam Meyers, CrowdStrike’s senior vice president of counter adversary work, says that the company has not yet attributed the activity to a specific actor, but that it fits into larger evolutions in how attackers like TeamPCP (which Crowdstrike tracks as “Altered Spider”) and North Korean groups are targeting the AI software supply chain.
“This is one of the campaigns that we’ve seen showing that this is an emerging attack class,” Meyers tells WIRED. “As AI coding agents become the development standard, supply chain threats are evolving to exploit those trust relationships. For the first time we’re experiencing how much AI and the AI toolchain has played into the broader tech ecosystem.”
The worm CrowdStrike identified works in phases. First it does reconnaissance to assess the target environment. Then it looks for access tokens and other sensitive data, like cryptographic keys and server access credentials that it can deliver to attackers. As the malware gains privileges, it further unpacks itself and continues to grab credentials, particularly “npm” tokens that give access to key software package management servers and other development capabilities like pull requests.
The deeper the malware bores into the system, the more sensitive data it can grab. At this point, the malware can also deploy its destructive capability, or what Meyers calls a “death switch,” to destroy files or block legitimate access to the compromised infrastructure.
The key finding, though, is that much of the worm’s malicious activity takes place in what are essentially blind spots, because so much of its behavior mimics legitimate actions. “It’s like a needle in a haystack except this is a needle in a needle stack,” Meyers says. “This looks very much like a lot of the automation organizations are using to build code, so it’s very difficult to detect.”
Meyers adds, too, that in these AI software development pipelines, it is harder to gather the data points that security scanners and analysis tools traditionally use to detect potentially suspicious activity.
“There’s a lot of telemetry overlap because legitimate AI coding systems are operating the same way as this worm, so it becomes very difficult to discern from the telemetry you have available to you what is legitimate and what is illegitimate,” Meyers says.
To hide in plain sight even more insidiously, the authors of the worm included time delays where various capabilities will execute hours or even days after the groundwork is laid, making it even harder for defenders to establish a cause and effect of certain events leading to certain outcomes.
Meyers says that Crowdstrike has been working on strategies to connect more of the dots, but he emphasizes that as AI software development explodes, there is a pressing need for all players to collaborate on structural solutions.
“It’s a limited detection surface because only so much of this activity is actually going to produce any sort of telemetry signal for us to look at,” Meyers says, “so it becomes extremely onerous to determine what is legitimate and what is illegitimate behavior.”
