As AI tools become deeply embedded in global software development, attackers are evolving their methods to exploit these systems. New research from the cybersecurity firm Crowdstrike shows how a worm discovered in the wild is actively targeting the AI toolchain to steal access credentials, gain deeper access, exfiltrate sensitive data, and deploy destructive capabilities—all while covering its tracks in victims' blind spots.
Worm Operations and Destructive Capabilities
The worm operates in phases, according to Adam Meyers, Crowdstrike's senior vice president of counter adversary work. It begins with reconnaissance to assess the target environment. Then it searches for access tokens and other sensitive data, such as cryptographic keys and server credentials, which it exfiltrates to attackers. As it gains privileges, it unpacks further and grabs npm tokens—credentials that provide access to software package management servers and development capabilities like pull requests.
At its most dangerous stage, the malware can deploy what Meyers calls a "death switch" to destroy files or block legitimate access to the compromised infrastructure. "This is one of the campaigns that we've seen showing that this is an emerging attack class," Meyers told WIRED. "As AI coding agents become the development standard, supply chain threats are evolving to exploit those trust relationships."
Detection Challenges in AI Development Pipelines
A key finding is that much of the worm's malicious activity takes place in blind spots because its behavior mimics legitimate actions. "It's like a needle in a haystack except this is a needle in a needle stack," Meyers said. "This looks very much like a lot of the automation organizations are using to build code, so it's very difficult to detect."
In AI software development pipelines, it is harder to gather the data points that security scanners traditionally use to detect suspicious activity. "There's a lot of telemetry overlap because legitimate AI coding systems are operating the same way as this worm, so it becomes very difficult to discern from the telemetry you have available to you what is legitimate and what is illegitimate," Meyers added.
The worm's authors also embedded time delays, causing various capabilities to execute hours or even days after initial compromise, further complicating forensic analysis.
| Worm Phase | Activity | Detection Difficulty |
|---|---|---|
| Reconnaissance | Assess target environment | Very low (mimics scans) |
| Credential theft | Steals npm tokens and server creds | Low (appears as normal API use) |
| Privilege escalation | Unpacks modules, gains deeper access | Medium |
| Destruction | "Death switch" deletes files | High (after delay) |
Implications for Enterprise Supply Chain Technology
For enterprise technology leaders—including CTOs and supply chain tech managers—this attack class poses a direct threat to the software supply chain. Many logistics and trade platforms now rely on AI-assisted development pipelines. If attackers poison the AI toolchain, they can inject vulnerabilities into the software that runs customs systems, warehouse management, or trade finance platforms.
Meyers noted that Crowdstrike has not yet attributed the activity to a specific actor but that it fits larger trends, including groups like TeamPCP (tracked as "Altered Spider") and North Korean groups targeting AI supply chains. "For the first time we're experiencing how much AI and the AI toolchain has played into the broader tech ecosystem," he said.
"There's a lot of telemetry overlap because legitimate AI coding systems are operating the same way as this worm." — Adam Meyers, CrowdStrike
Crowdstrike is working on strategies to connect more dots, but Meyers stresses the need for industry-wide collaboration on structural solutions. "It's a limited detection surface because only so much of this activity is actually going to produce any sort of telemetry signal for us to look at," he said.
For organizations adopting AI in their supply chain technology stacks, understanding these blind spots is critical. The worm's ability to hide in plain sight demands that detection methods evolve beyond traditional signatures to behavioral analysis—and that developers monitor exactly what AI coding agents are doing.
Sources:
