Hackers Target AI Coding Tools to Steal Credentials as Researchers Uncover 103 AI-Linked Cyber Incidents
Hackers exploit AI coding tools to steal credentials, with 103 AI-linked cyber incidents reported.
A threat intelligence report identified 103 AI-linked cyber incidents between July 2025 and July 2026, revealing that attackers are increasingly targeting AI coding assistants and developer integrations to steal credentials and gain access to connected systems. The research indicates that criminals are using AI to enhance familiar attack methods like supply-chain compromise and phishing, rather than relying on fully autonomous AI operations. Compromised AI tool packages and malicious updates have been used for credential theft, data harvesting, and backdoor persistence.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Recorded Future?
Get an email when a new story names Recorded Future, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are increasingly targeting AI coding assistants and developer tool integrations as a supply chain attack surface, using compromised packages and malicious updates to steal credentials and establish backdoor persistence. The core problem is that developers implicitly trust AI tooling ecosystems, creating a high-value, low-scrutiny entry point into connected systems and cloud environments. Because developers often have broad access to source code, secrets, and infrastructure, a single compromised AI tool can cascade into a significant breach. This matters because AI tools are rapidly proliferating across development workflows, dramatically expanding the attack surface without a corresponding increase in vetting rigor.
What helps against this
How we list vendors
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Shai-Hulud