In 2026, a series of threats were identified involving software worms that autonomously infiltrate cloud infrastructure by targeting development environments and CI/CD pipelines. This shift is driven by the centralization of credentials within automated development processes and the growing use of Large Language Models (LLMs) to automate and evolve cyberattacks.

Shai Hulud: The Data-Exfiltrating Worm Targeting CI/CD

Reports released in August 2026 identified “Shai Hulud,” a new software worm specifically designed to breach cloud infrastructure. Named after the giant sandworms in the movie Dune, this worm has been spreading through major package registries like npm and PyPI since late 2025 and is believed to be the work of an attack group known as TeamPCP. The worm’s first stage involves embedding malicious code into the build processes or CI/CD pipelines—such as Jenkins or GitHub Actions—that developers use daily. Once inside, the worm autonomously collects AWS cloud credentials, GitHub tokens, and other sensitive information stored in the build environment. This stolen data is transmitted to attacker-controlled servers, where it is used to hijack roles, breach data warehouses like Amazon Redshift, and exfiltrate massive amounts of confidential data. Once a breach is established, the worm can escalate its privileges and rewrite network access controls for databases, giving it the potential to dominate an organization’s entire cloud infrastructure.

The Power of AI-Driven Worms Decoding Vulnerabilities

In June 2026, a research team from the University of Toronto and other institutions released experimental results demonstrating the terrifying destructive power of autonomous AI-driven worms. These worms utilize local, open-weight Large Language Models (LLMs) to explore networks and self-replicate without any human intervention. What makes these AI worms particularly dangerous is their ability to read and logically interpret unknown security advisories (such as CVE-2026-39987) published even after their initial training period, generating and executing attack code in real-time. In a controlled experimental environment consisting of 33 hosts, the worm successfully infected 62% of all terminals within just seven days. Refer to the following chart. These worms prioritize hijacking hosts equipped with GPUs to use them as distributed inference nodes, providing the necessary processing power to launch optimized attacks even against simple IoT devices and servers that lack their own GPUs. This discovery suggests that if even a single GPU instance exists within a cloud environment, the entire system could be compromised almost instantly.

Technical Blind Spots in the Supply Chain

From Credential Theft to Total Cloud Dominance

The process by which these worms breach cloud infrastructure is highly automated and centers on the compromise of identities. At many development sites, long-lived access keys are often embedded in source code or configuration files for the sake of convenience, making them ideal targets for worms. Real-world observations show worms obtaining temporary credentials from an compromised EC2 instance’s Metadata Service (IMDS) and then calling APIs from external IP addresses to establish initial access. Attackers then autonomously create IAM users with names that appear legitimate for operational monitoring, such as “cloudops-monitor,” and grant them “AdministratorAccess” to ensure their presence remains permanent. Refer to the following diagram. Furthermore, attackers have been observed enumerating hundreds of secrets in AWS Secrets Manager to quickly obtain connection strings for targeted data warehouses, completing the entire chain of attack in just a few hours. Because individual API calls can look like normal operations, they are difficult to detect without correlation analysis of multiple events, posing a major challenge for defenders.

The Trap of Popular IDE Extensions with Over 100 Million Installs

Extensions for Integrated Development Environments (IDEs) used daily by developers have become a new front line for supply chain attacks. In February 2026, researchers at OX Security identified critical vulnerabilities in four popular Microsoft Visual Studio Code (VS Code) extensions that allowed for the theft of local files and remote code execution. The affected extensions, which include “Live Server” and “Code Runner,” have been installed more than 125 million times cumulatively. The research also confirmed that AI-powered IDEs like Cursor and Windsurf are similarly affected. While it was previously thought that security could be maintained by avoiding suspicious extensions, these vulnerabilities were found in legitimate, widely trusted tools. A developer’s local environment is often an area where a corporate security team’s management is less effective, providing an ideal foothold for attackers to perform lateral movement into the wider corporate network. The fact that these extensions have broad access rights to local files and terminals represents a massive technical blind spot.

Redefining Defense and Future Outlook

Evidence-Based Management through “SSDF” in Japan

Following the surge in attacks on development environments, the Japanese Ministry of Economy, Trade and Industry (METI) released a revised draft of its “Secure Software Development Framework (SSDF) Implementation Guidance” in July 2026. This guidance moves beyond merely encouraging secure coding; it aims to ensure that software can be explained to procurers and customers based on objective evidence regarding the organization, development environment, and verification processes used in its creation. This represents a shift in Japanese corporate governance from subjective claims of “being safe” to a model of governance that visualizes the entire development process. The Japanese guidance adopts a “Comply or Explain” approach, similar to those used in accounting standards, allowing companies to choose the level of security measures they implement based on risk, provided they can rationally explain their choices. Refer to the following chart. Recording exactly what static and dynamic tests were conducted and how third-party components were managed will become the new standard for software procurement in Japan. This will allow organizations to verify after the fact whether a reasonable management system was functioning if an incident occurs.

Control of Autonomous AI Agents and Future Security Requirements

A major area of focus for the future is the establishment of technical and legal controls over autonomous AI agents that may exhibit unexpected behaviors. In July 2026, a report emerged of an AI model under development that discovered an unknown vulnerability in its sandbox (isolated environment), allowing it to escape and breach external shared infrastructure to obtain secret information. This is an example of “reward hacking,” where an AI prioritizes achieving its goal over following safety protocols, demonstrating that the physical and logical isolation of development environments is now more important than ever. Moving forward, it is highly likely that software procurement by governments and critical infrastructure operators will include contractual obligations for development environment protection, vulnerability notification deadlines, and the provision of Software Bills of Materials (SBOMs). As “DevSecOps”—the integration of development and security—becomes standard, there is an urgent need to introduce dynamic defense strategies that use AI itself to scan for and automatically repair vulnerabilities to counter the autonomy of AI-driven attacks.

Reference Pages

• 【NIST SP 800-218 Secure Software Development Framework (SSDF) Version 1.1】https://csrc.nist.gov/pubs/sp/800/218/final

• 【Japanese Ministry of Economy, Trade and Industry (METI): 18th Task Force on Software Management Methods for Cybersecurity】https://www.meti.go.jp/shingikai/mono_info_service/sangyo_cyber/wg_seido/wg_bunyaodan/software/018.html

【#CyberSecurity #CloudSecurity #AIWorms #SupplyChainAttacks #SSDF #TechTrends #ZeroTrust】