Cyberattackers have discovered a new way to evade detection by leveraging artificial intelligence (AI) coding assistants and continuous integration (CI) pipelines. By hiding malicious activity within these trusted tools, attackers can make their exploits virtually indistinguishable from normal activity, posing a significant challenge for security teams.
One early example of this emerging threat is Sandworm_Mode, a self-propagating worm that spreads through malicious npm packages. Researchers at Socket Security discovered the threat earlier this year and described it as a Shai-Hulud-style worm that hijacks CI workflows and poisons AI toolchains. This type of attack mimics routine developer behavior so closely that some detection techniques may fail to identify it.
CrowdStrike, a cybersecurity firm, analyzed Sandworm_Mode’s behaviors to identify the ones they could detect using existing telemetry. The analysis revealed that only nine out of 14 investigated behaviors generated any detectable signal, and just two produced signals reliable enough to trigger customer alerts. The remaining behaviors closely resembled legitimate development and automation activity, making it difficult to distinguish them from normal behavior.
This finding highlights a critical issue: without understanding what “normal” looks like for AI-augmented environments, there is no foundation for anomaly-based detection. Baselines are still being established across the industry, and this lack of understanding creates a significant gap in security defenses. CrowdStrike’s findings demonstrate that attackers are increasingly abusing trusted AI toolchains in a manner similar to living off the land attacks.
Sandworm_Mode spreads through 19 malicious npm packages and exploits normal runtime behaviors of AI coding assistants, CI automation, and large language model (LLM) toolchains. The worm is designed to steal credentials from various platforms, including npm, GitHub, cloud services, cryptocurrency exchanges, and LLM providers. It propagates by infecting packages and repositories, establishing persistence through Git hooks, and compromising AI assistants like Cursor and Claude Code.
The 48- to 96-hour delay between when a malicious package is installed and when its full payload activates ensures that detection tools relying on correlating installation and behavior signals may never connect the two. This delay makes it even more challenging for security teams to detect and respond to Sandworm_Mode attacks.
While some behaviors of Sandworm_Mode did produce usable detection signals, several others were effectively indistinguishable from legitimate developer activity. The worm executed commands, accessed files, modified configurations, interacted with repositories, and called APIs in ways that closely resembled normal behavior of AI assistants, CI/CD systems, and other development tools.
The security implications of this emerging threat are significant. As AI coding agents become the standard for software development, adversaries will continue to learn how to live off the AI toolchain by exploiting trusted workflows used every day. Organizations must adapt their security strategies to account for these new threats, establishing baselines for normal behavior in AI-augmented environments and developing detection techniques that can effectively identify malicious activity within these tools.
To stay ahead of this threat, organizations should focus on understanding the normal behavior of their AI-augmented environments and develop detection techniques that can identify anomalies. By doing so, they can better protect themselves against attacks like Sandworm_Mode and prevent attackers from living off the AI toolchain.
Source: Dark Reading — 2026-07-22