As attackers continue to evolve and adapt their tactics, a disturbing trend has emerged in the world of cybersecurity. Threat actors are learning to exploit trusted AI toolchains and workflows, making malicious activity increasingly difficult to detect. This emerging threat is exemplified by Sandworm_Mode, a self-propagating worm that spreads through malicious npm packages and leverages trusted AI coding assistants and CI pipelines to evade detection.
Sandworm_Mode was first discovered earlier this year by researchers at Socket Security, who described it as a “Shai-Hulud-style” worm that hijacks CI workflows and poisons AI toolchains. The threat has since been analyzed in depth by CrowdStrike, which found that only nine of the 14 behaviors investigated generated any detectable signal, with just two producing signals reliable enough to trigger customer alerts. The remaining behaviors were so indistinguishable from legitimate activity that it was not possible to reliably distinguish them from normal development and automation behavior.
The problem lies in the fact that without a solid understanding of what “normal” looks like for AI-augmented environments, there is no foundation for anomaly-based detection. This is a new challenge for cybersecurity professionals, who are struggling to establish baselines for telemetry classes such as MCP server deployments, AI assistant configuration writes, and LLM API key usage.
Sandworm_Mode itself spreads through 19 malicious npm packages and exploits the normal runtime behaviors of AI coding assistants, CI automation, and LLM toolchains. The worm is designed to steal credentials from various platforms, including npm, GitHub, cloud services, cryptocurrency exchanges, and LLM providers. It propagates by infecting packages and repositories, establishing persistence through Git hooks, and compromising AI assistants such as Cursor and Claude Code via a rogue MCP server that uses prompt injection to trick them into silently reading and passing credentials to the attacker.
One of the most insidious features of Sandworm_Mode is its ability to evade detection tools. The worm includes a 48- to 96-hour delay between when a malicious package is installed and when its full payload activates, ensuring that detection tools relying on correlating installation and behavior signals may never connect the two.
CrowdStrike’s findings highlight the challenges organizations will face as attackers increasingly abuse the AI toolchain in a manner similar to living off the land attacks. The security vendor emphasizes the need for a more nuanced understanding of what constitutes “normal” behavior in AI-augmented environments, as well as the development of new detection rules and strategies that can keep pace with these emerging threats.
In the face of this evolving threat landscape, organizations must take proactive steps to protect themselves. This includes establishing robust baselines for telemetry classes, developing more advanced anomaly-based detection capabilities, and staying up-to-date with the latest AI toolchain vulnerabilities and exploits. By doing so, we can mitigate the risks associated with these emerging threats and ensure that our reliance on AI toolchains does not become a liability in the face of cyber attacks.
Source: Dark Reading — 2026-07-22