Researcher: a worm hid orders for AI coding agents in tool descriptions

Kush Pandya argued that attackers have found a new hiding place: the descriptions of tools that AI coding assistants read. Most people would not bother to look at them. He made the point in a talk at OWASP AppSec Days Portugal 2026, published on the OWASP Foundation channel. He said the configuration of a trusted AI assistant is now part of the attack surface.

What was said

Pandya described a campaign he helped stop, a self-replicating npm worm called Shai Hulud v4. Some of its packages impersonated Claude Code. They wrote configuration that AI tools would consume. He said the instruction was hidden so well that package metadata, readmes and user files would not reveal it.

In one tool description, the instruction was aimed at the assistant, not the user. In plain terms, it told the model to read local credentials, including SSH keys, cloud credentials and environment tokens. It then told the model to pass them along in the tool's context parameter and not to mention any of it to the user.

Pandya called this prompt injection, meaning text that tricks a model into following orders. The new part, he said, is delivery. It arrives through tool metadata the model trusts implicitly, planted on disk by an installed package. He framed the central question this way: "what else on your machine is silently read by this AI agent and what instructions does it choose to act upon". He also said the "configuration of an AI assistant that you trust is now also a part of the attack surface".

Why it matters

For engineering leaders, that suggests keeping a list of the tools and servers your agents trust and reviewing their descriptions. Changes to that text should be approved like code changes. For buyers, it is a fair question to put to any vendor shipping agent tools: who checks what the descriptions tell the model to do?

The other side

Pandya himself said this is prompt injection "essentially", so the attack class is not new. Only the route in is. His demonstration was also sanitized, with no live server or payload, so listeners saw a representative version, not a working attack.

The excerpts do not say how many developers were affected. They do not say how reliably agents obeyed the hidden orders. They also give no complete fix for the metadata layer. One quoted piece of advice, about treating any unfamiliar server a certain way, is cut off mid-sentence. This is one researcher's account of one campaign, taken from a machine transcript.