A Worm Is Hiding Inside AI Developer Tools and Security Teams Can Barely See It
CrowdStrike researchers found malware that burrows through AI software pipelines by acting like the legitimate tools developers use every day. That camouflage makes it nearly invisible to standard defences.
Key points
- CrowdStrike, a cybersecurity firm, discovered a self-spreading piece of malware, called a worm, actively targeting the tools and systems developers use to build AI software.
- The worm steals access credentials, cryptographic keys and server passwords, then can destroy files or lock out legitimate users entirely.
- Its behaviour so closely mirrors normal AI development automation that security scanners struggle to tell the two apart.
- CrowdStrike links the broader attack trend to threat actors including North Korean groups and a group it tracks as "Altered Spider" (also known as TeamPCP).
- Adam Meyers, CrowdStrike's senior vice president of counter adversary work, described the detection problem as "a needle in a needle stack."
A worm is a piece of malware, that is, malicious software, that copies and spreads itself without the victim needing to click anything. CrowdStrike researchers found one of these while investigating attacks on AI software supply chains, the networks of tools, code libraries and automated systems that developers use to build software. First reported by Wired AI, the finding adds a worrying chapter to an already complicated security picture.
The worm moves through a target environment in stages. It starts quietly, looking around to understand what systems it has reached. Then it hunts for access tokens and cryptographic keys, which are like digital passwords and padlocks that grant entry to servers and software systems. Once it gathers those, it sends them back to the attackers.
As it gains more access, it digs deeper. It specifically targets "npm" tokens, credentials that control access to software package repositories, the shared libraries where developers store and share reusable code. Whoever holds those tokens can push malicious code out to other developers who trust those libraries.
Deep enough inside a system, the worm can flip what Meyers calls a "death switch." That means destroying files or blocking the organisation's own staff from accessing their infrastructure.
The real problem is visibility, or the lack of it.
AI coding tools are already highly automated. They run scans, pull code, make requests and shuffle data around constantly. The worm does the same things. To a security scanner, the malware and the legitimate tool look identical.
"It's like a needle in a haystack except this is a needle in a needle stack," Meyers told researchers. The telemetry data, the logs and signals that security tools use to spot trouble, overlaps almost completely between the worm and genuine AI development activity.
The worm's authors also built in time delays. Some capabilities activate hours or even days after the malware first lands, breaking the chain of cause and effect that investigators rely on to reconstruct an attack.
Meyers says CrowdStrike is working on new detection approaches, but he stresses that the industry as a whole needs to collaborate on structural fixes before AI-assisted development becomes even more widespread.
Should developers and their organisations be worried?
Yes, and the concern extends beyond individual developers to any organisation that uses software built with AI coding tools. If a development pipeline is compromised, malicious code can travel downstream into products that customers and employees rely on every day.
Watch for these signs: unexpected changes to software package configurations, access tokens that appear used at unusual hours, and automated build processes that run without a clear trigger are all worth investigating. Security teams should also audit which systems hold npm tokens or similar credentials and treat those with the same care as master passwords.
