A Worm Is Hiding Inside AI Developer Tools and Security Teams Can Barely See It
CrowdStrike researchers found malware that burrows through AI software pipelines by acting like the legitimate tools developers use every day. That camouflage makes it nearly invisible to standard defences.
Key points
- CrowdStrike, a cybersecurity firm, discovered a self-spreading piece of malware, called a worm, actively targeting the tools and systems developers use to build AI software.
- The worm steals access credentials and cryptographic keys, then can destroy files or lock out legitimate users entirely.
- Its behaviour so closely mirrors normal AI development automation that security scanners struggle to tell the two apart.
- CrowdStrike has not attributed the activity to a specific actor, but links the broader attack trend to North Korean groups and a group it tracks as "Altered Spider" (also known as TeamPCP).
- Adam Meyers, CrowdStrike's senior vice president of counter adversary work, described the detection problem as "a needle in a needle stack."
A worm is malicious software that copies and spreads itself without the victim needing to click anything. CrowdStrike researchers found one while investigating attacks on AI software supply chains, the networks of tools and code libraries that developers use to build software. First reported by Wired AI, the finding lands at a moment when AI coding pipelines are becoming standard infrastructure across the industry.
Our earlier story on slopsquatting, published 14 July 2026, showed how criminals exploit AI assistants that invent fake software packages. This worm attacks the same layer of trust, but from the inside.
The worm moves through a target environment in stages. It starts quietly, assessing what systems it has reached. Then it hunts for access tokens and cryptographic keys, digital credentials that grant entry to servers and software systems, and sends them back to the attackers.
As it gains access, it digs deeper. It specifically targets "npm" tokens, credentials that control access to software package repositories where developers store and share reusable code. Whoever holds those tokens can push malicious code to other developers who trust those libraries.
Deep enough inside a system, the worm can flip what Meyers calls a "death switch": destroying files or blocking an organisation's own staff from their infrastructure.
The real problem is visibility. AI coding tools are already highly automated. They run scans, pull code and shuffle data constantly. The worm does the same things, so a security scanner sees near-identical activity from both.
"It's like a needle in a haystack except this is a needle in a needle stack," Meyers told Wired AI. Legitimate AI development and the worm produce overlapping telemetry, the logs and signals security tools use to spot trouble, making separation extremely difficult.
Time delays compound the problem. Some capabilities activate hours or days after the malware lands, severing the cause-and-effect chain investigators rely on to reconstruct an attack. It's a deliberate design choice, and it works.
Meyers says CrowdStrike is working on new detection approaches, but stresses the industry as a whole must collaborate on structural fixes before AI-assisted development becomes even more widespread.
Should developers and their organisations be worried?
Yes, and the concern extends beyond individual developers to any organisation that uses software built with AI coding tools. If a development pipeline is compromised, malicious code can travel downstream into products that customers and employees rely on every day.
Security teams should watch for unexpected changes to software package configurations and access tokens used at unusual hours. Automated build processes that run without a clear trigger are also worth investigating. Any system holding npm tokens or similar credentials deserves the same protection as a master password. The worm's authors clearly know that most organisations don't treat them that way.
