Hackers Target AI Coding Tools to Steal Credentials as Researchers Uncover 103 AI-Linked Cyber Incidents

Hackers are targeting AI coding assistants, software packages, and developer integrations to steal credentials and gain access to connected systems.

A new threat intelligence report examined 103 AI-linked cyber incidents, showing how tools trusted with source code and sensitive data are becoming entry points for attackers.

The research covered July 31, 2025, through July 31, 2026. Its central finding is less about machines independently running attacks and more about criminals using AI to improve familiar methods, including software supply-chain compromise, phishing, credential theft, and extortion.

Fully autonomous operations remain uncommon. Researchers from Recorded Future’s Insikt Group noted credential-stealing malware in compromised AI tool packages, alongside the Shai-Hulud worm’s expansion into Claude Code.

Their AI cyber threat report describes attackers exploiting the access these tools already hold, rather than breaking capabilities unique to artificial intelligence.

Hackers Target AI Coding Tools

Developer systems offer attackers more than passwords. Coding assistants and supporting packages can reach repositories, credentials, connected applications, and business data.

A compromised dependency can therefore become a starting point for data theft, persistent access, and lateral movement into other parts of an organization.

In late February 2026, attackers compromised a popular AI proxy package that connects applications to different large language models.

Malicious updates enabled credential theft, lateral movement, and backdoor persistence. Another compromise in April used AI tool packages to harvest credentials, steal data, and access cryptocurrency wallets.

Related reporting on malicious AI coding plugins illustrates the same trust problem: developers entered provider API keys into seemingly useful extensions, which secretly forwarded those keys to attacker-controlled infrastructure.

These incidents show why approving an editor does not automatically make every installed plugin safe. The report also describes a May expansion of Shai-Hulud that targeted Claude Code to maintain access and spread.

Its broader warning is that widely deployed development tools can expose potentially thousands of downstream environments when attackers compromise a trusted component.

Attackers are also exploiting demand for AI products through fake download pages, search poisoning, and ClickFix lures.

Separate coverage of fake Claude Code installers documented pages that persuaded users to execute commands, triggering PowerShell stages and credential theft. Recorded Future observed AI-themed lures increasing significantly after March 2026.

What the 103 Incidents Reveal About AI Cybercrime

The dataset includes incidents involving AI as an attack tool, target, or delivery mechanism. Recorded Future required documented malicious activity, rather than ordinary demonstrations or security research.

Consequently, the total should not be read as 103 autonomous attacks or 103 confirmed breaches of AI providers. Of those incidents, 32 involved AI in malware or offensive operations.

The remaining 71 covered attacks against AI infrastructure, AI-themed malware delivery, AI-assisted deception, and abuse of legitimate services. Nine of the 32 malware and operations cases involved state-sponsored intelligence collection.

Most state-backed activity used AI to help develop malware, hide code, or support targeting. One reported campaign against Taiwanese government entities used up to eight AI agents with limited human intervention.

However, operational risk, reliability problems, and high usage costs still limit fully autonomous attacks. AI also helps criminals extract value from stolen information.

Recorded Future described The Gentlemen ransomware group using language models to review stolen material and shape extortion demands.

Separately, infostealers targeting AI credentials demonstrate why investigations must cover access tokens, refresh tokens, and API keys, not just passwords.

For defenders, the priority is controlling what coding agents can access and change. Recorded Future recommends separating agents from sensitive systems, requiring approval for consequential actions, maintaining independent monitoring, and auditing AI dependencies, plugins, and model repositories for backdoors or malicious command injection.

Teams should also monitor exposed developer API keys, corporate OAuth tokens, and stolen AI subscriptions. The report expects human-directed automation to expand before fully autonomous campaigns, making strong access controls and third-party oversight immediately relevant defenses rather than measures reserved for a future threat.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post Hackers Target AI Coding Tools to Steal Credentials as Researchers Uncover 103 AI-Linked Cyber Incidents appeared first on Cyber Security News.