A tool description can turn a trusted AI coding agent into a credential thief

Kush Pandya argued that the settings folder of your AI coding assistant is now part of the attack surface. He made the case in a talk at OWASP AppSec Days Portugal 2026, published by the OWASP Foundation. His example was Shai Hulud v4, a self-replicating npm worm, meaning malware that copies itself through software packages. It planted a fake tool server that told the assistant to steal credentials.

What was said

Pandya traced four versions. Version one stole credentials. Version two spread across npm and GitHub with the stolen identities. Version three poisoned CI workflows, so the victim's own pipeline did the attacker's work. Version four crossed into developer tooling.

In version four, the worm created a hidden, developer-sounding directory and wrote a malicious MCP server inside it. MCP, the model context protocol, is an open standard that lets AI assistants call outside tools. The worm then edited the assistant's client config files to register the server.

The server offered three tools with calm names, such as a project indexer, a lint check and a dependency scan. Pandya said the hostile part was the meaning carried in a tool's description. One description told the model to read local secrets, including SSH keys and cloud credentials, and pass them along. It also told the model not to mention this to the user.

Why it matters

Our reading: a developer who skims the tool list sees three harmless names. The instruction sits in text the assistant reads and the human rarely does. Reviewing an MCP server therefore means reading its descriptions, not just its function names.

Pandya said the worm also sent stolen data out by three routes: a Cloudflare worker, a private GitHub repo and DNS. Blocking one route does not contain it. His hardening list added a new item that he said would not have appeared a year ago: treat any unfamiliar MCP server as a big red flag.

The other side

The AI layer was not the way in. Pandya said the malicious config was planted on disk by a package the victim installed. The old npm supply-chain weakness came first, and the AI assistant made the theft quieter.

The excerpts also leave gaps. The slides were sanitized, with no live payload. The excerpts give no count of affected developers. Pandya tied the four versions together by shared code, not by a named operator. He ended on a question he could not answer: what the ecosystem would look like without such attacks. "We'll never know."