The rapid adoption of AI coding assistants is creating new opportunities for cyber attackers to compromise software supply chains and manipulate automated development tools, according to Google Threat Intelligence Group.
New research from GTIG has found attackers are increasingly targeting the intersection between artificial intelligence, developers and open source software as AI becomes embedded into software development.
Google said AI-assisted coding has accelerated development and increased the amount of open source software available, including resources specifically designed to support AI applications.
However, the speed of development may also result in reduced scrutiny of third-party packages and dependencies, creating opportunities for attackers.
GTIG believes AI-assisted coding practices contributed to significant software supply chain compromises observed during 2025 and early 2026.
The threat intelligence group has highlighted activity associated with financially motivated threat actor UNC6780, also known as TeamPCP, which has conducted large-scale software supply chain compromises targeting ecosystems including PyPI, npm and Docker Hub since March.
The attackers compromised legitimate developer accounts and published malicious versions of legitimate software resources, with some attacks specifically designed to interact with AI coding tools.
GTIG said the group’s DUSTMAKER credential-stealing malware included multiple techniques designed to exploit AI development environments.
These included placing malicious files inside hidden project directories used by AI coding assistants and development environments, allowing malicious activity to blend into normal developer workflows.
The malware could also use configuration files to issue instructions to AI assistants, effectively attempting to manipulate them into executing attacker-controlled commands during normal development activities.
Another technique involved embedding adversarial prompt injection into malicious JavaScript in an apparent attempt to cause LLM-based security scanners to refuse or skip analysis of the underlying code.
GTIG said the activity illustrates how attackers are adapting established supply chain techniques for development environments where AI tools increasingly make or recommend decisions.
The threat extends beyond coding assistants.
Google’s research found adversaries are moving more broadly towards agentic AI and AI-enabled automation, including systems capable of autonomously managing scanning, troubleshooting operational problems and harvesting credentials.
In one operation observed during the second quarter, attackers compromised a cloud resource and subsequently planned, developed and executed an agent-enabled mass credential harvesting campaign in less than six hours.
Despite the rapid development of AI capabilities, Google said it has not yet observed threat actors using fully autonomous systems to discover and exploit zero-day vulnerabilities against targets in the wild.
Instead, GTIG believes attackers are progressively incorporating AI into existing techniques to increase speed and scale.
The findings suggest organisations adopting AI-assisted development will need to consider the security of the AI tools themselves alongside traditional controls around code repositories, software dependencies, developer credentials and CI/CD environments.
