A newly observed worm is exploiting the same automation patterns that make AI-assisted software development useful, according to research reported by WIRED. CrowdStrike says the malware targets AI toolchains to steal credentials, gain deeper access, exfiltrate sensitive data, and potentially destroy files.
The company has not attributed the campaign to a specific actor. Its researchers say the activity fits a broader shift toward attacks on software supply chains used by AI coding agents and related infrastructure.
The worm first profiles the environment, then searches for access tokens, cryptographic keys, server credentials, and npm tokens. As it gains privileges, it unpacks additional capabilities and can delay some actions for hours or days, making detection harder.
The difficult part for defenders is that much of the behavior resembles legitimate automation. AI coding systems already interact with repositories, packages, and build tools at high speed, so malicious activity can blend into normal telemetry. That means organizations adopting AI development tools may need tighter credential handling and monitoring designed for agent-driven workflows, not only traditional developer activity.