CrowdStrike says it found a worm actively targeting AI development infrastructure, putting software teams’ build systems, package credentials and internal data in the blast radius. The uncomfortable bit for defenders is that the malware does not need to look exotic. According to the security firm, much of its behavior resembles the automation that developers already allow inside modern coding pipelines.
The company published research on AI toolchain supply chain attacks and said the worm was discovered in the wild during that work. Adam Meyers, CrowdStrike’s senior vice president of counter adversary operations, told WIRED that the firm has not attributed the activity to a named hacking group.
Meyers said the campaign fits a broader shift in attacker behavior as groups focus more attention on AI software supply chains. CrowdStrike tracks TeamPCP as “Altered Spider,” and Meyers also pointed to North Korean groups as examples of attackers targeting this part of the development stack.
How the worm moves
According to CrowdStrike, the malware works in stages. It first surveys the victim’s environment, then searches for useful secrets: access tokens, cryptographic keys and server credentials. Those are the small strings that make modern software factories run, and also the small strings attackers love because they often unlock larger systems without much drama.
As the worm gains more permissions, CrowdStrike says it expands its activity and keeps collecting credentials. One target is npm tokens, which can provide access to package-management infrastructure and development workflows such as pull requests. In other words, the worm is not only looking for a laptop to loot. It is looking for the connective tissue between code, packages and deployment.
CrowdStrike says the malware can also switch from theft to damage. Meyers described a destructive capability as a “death switch” that can wipe files or prevent legitimate users from reaching compromised infrastructure. The research does not identify a specific victim or name the attackers behind the campaign.
The detection problem
The harder problem, according to CrowdStrike, is visibility. AI coding agents and development automation already read repositories, call tools, move credentials through approved systems and trigger changes. CrowdStrike’s finding is that the worm blends into that noise because its actions overlap with legitimate AI-assisted software work.
Meyers told WIRED that defenders are trying to find malicious activity inside a pile of similar-looking activity. He said the available telemetry, the security data generated by systems under watch, can be too limited or too ambiguous to separate authorized automation from the worm’s operations.
The malware’s authors also added delays, according to CrowdStrike. Some functions can run hours or days after earlier steps, which makes incident response messier. If a credential is harvested on Monday and a destructive action fires later, defenders have a harder time tying cause to effect from logs alone.
Meyers said CrowdStrike is working on ways to connect more of those signals. He also argued that the problem needs broader collaboration because AI development pipelines are spreading faster than the detection models built for older software environments. That is security-vendor phrasing, yes, but the mechanical point is plain enough: if companies hand coding agents broad access and then log only a sliver of what they do, attackers get room to impersonate the machinery.
This story draws on original reporting from WIRED.
