As AI tools proliferate, attackers are increasingly targeting the AI toolchain. A newly discovered worm works by mimicking legitimate actions, making it incredibly difficult for security teams to detect. The malware gathers credentials and can deploy destructive capabilities, all while remaining hidden.

The worm’s creators include time delays in its operations, ensuring that its activities blend seamlessly with normal development processes. This makes it nearly impossible to distinguish between what’s legitimate and what’s suspicious based on telemetry data alone.

According to Adam Meyers of CrowdStrike, this is an emerging attack class as AI coding agents become the new standard for software development. The worm operates in blind spots where its behavior mimics genuine activity, allowing it to infiltrate and exfiltrate sensitive information undetected.

The challenge lies in the complexity of AI software development pipelines, where traditional security tools struggle to gather the necessary data points to identify potential threats. As such, collaboration across the tech industry is crucial to developing structural solutions for this evolving threat landscape.