August 07, 2026
Estimated reading time: 5 minutes
Key takeaways:
- 81% of teams give AI-coding agents write access; only 7% keep it read-only. That’s what Shai-Hulud exploited.
- Nearly a quarter reuse human credentials for agents, only 7% manage agent identity properly.
- AI security policies are rising, but core controls (rotation, monitoring, revocation) remain rare.
The recent Shai-Hulud campaign, a self-propagating malicious software program, targeted an increasingly common part of the software development workflow: AI-coding assistants.
Microsoft’s analysis of the campaign showed attackers compromising the configuration files used by tools such as Claude Code to spread malicious instructions between developer environments.
Join LeadDev.com for free to access this content
August 07, 2026
