Attackers Are Learning to Live Off the AI Toolchain
Attackers are increasingly leveraging AI coding assistants and CI/CD pipelines to hide malicious activity, a trend exemplified by the Sandworm_Mode worm. This ‘living off the AI toolchain’ approach makes detection incredibly difficult, as the malware mimics legitimate developer behavior and blends into existing workflows. CrowdStrike researchers highlight the need for organizations to adapt their security strategies and extend protection beyond traditional endpoint defenses into the entire AI development lifecycle.
Attackers are increasingly utilizing AI coding assistants and CI/CD pipelines to conceal malicious activity, a tactic demonstrated by the Sandworm_Mode worm. This represents a shift towards ‘living off the AI toolchain,’ where attackers exploit trusted workflows used by developers to evade detection. CrowdStrike researchers have identified this as a growing threat, noting that it significantly complicates traditional security approaches.
Sandworm_Mode is a self-propagating worm that spreads through malicious npm packages. The security vendor, CrowdStrike, analyzed the worm’s behaviors and found that only nine of the 14 investigated produced detectable signals, and only two generated signals reliable enough to trigger customer alerts. The remaining behaviors closely resembled legitimate developer and automation activity, making it nearly impossible to distinguish them from normal behavior.
The worm is designed to steal npm, GitHub, cloud, cryptocurrency, and LLM-provider credentials, and exfiltrate them across three channels, including DNS tunneling. It propagates by infecting packages and repositories and establishes persistence through Git hooks. Sandworm_Mode also compromises AI assistants such as Cursor and Claude Code via a rogue MCP server that uses prompt injection to trick them into silently reading and passing credentials to the attacker. The worm has a 48- to 96-hour delay between package installation and payload activation, further complicating detection efforts.
CrowdStrike characterized Sandworm_Mode as a proof-of-concept for a new attack class, emphasizing the need for organizations to proactively address vulnerabilities within the AI development ecosystem. To combat this, CrowdStrike recommends extending security into the AI development lifecycle, starting with protecting developer identities and credentials, increasing visibility across package repositories and CI/CD pipelines, and isolating AI development environments where appropriate.
“The challenge is that you’re looking for a needle in a needle stack,” said Adam Meyers, head of counter adversary operations at CrowdStrike. “AI coding assistants and attacks like Sandworm_Mode generate much of the same telemetry, making it extremely difficult to distinguish legitimate behavior from malicious behavior using traditional approaches alone.”