# When Your AI Coding Assistant Becomes the Attack Surface
The name is a deliberate joke. Sandworm_Mode — a worm that travels through the AI toolchain the way the giant sandworms of Arrakis travel through sand, silently, beneath the surface, consuming everything in their path. The researchers at Socket Security who named it clearly have taste. The security teams who have to defend against it may not be laughing.
Last week, CrowdStrike published findings from their analysis of Sandworm_Mode's behaviors against their own detection capabilities. The numbers are uncomfortable: of 14 distinct malicious behaviors the worm exhibits, only nine generated any detectable signal at all. Two — just two — produced signals reliable enough to actually alert a customer. The other behaviors blended so perfectly into legitimate development activity that CrowdStrike's analysts couldn't reliably tell them apart from normal work.
That's not a bug report. That's a structural problem.
## The Living-off-the-Land Playbook, Rewritten
The security industry spent roughly a decade learning to counter living-off-the-land (LOtL) attacks — threat actors who stopped bringing their own tools and instead weaponized what was already there: PowerShell, WMI, certutil, legitimate admin utilities. It took years and enormous effort to build behavioral baselines, anomaly detection, and telemetry pipelines capable of distinguishing a sysadmin from an attacker using identical commands.
Sandworm_Mode represents the same problem, reset to zero, on a new surface.
The worm spreads through malicious npm packages — 19 of them have been identified — and once inside a development environment, it exploits the normal runtime behavior of AI coding assistants, CI/CD automation pipelines, and LLM toolchains. It writes to AI assistant configuration files. It makes calls to LLM APIs. It interacts with Model Context Protocol (MCP) servers. Every action looks, from a telemetry standpoint, exactly like a developer doing their job.
"Without understanding what 'normal' looks like for MCP server deployments, AI assistant configuration writes, and LLM API key usage in a given environment, there is no foundation for anomaly-based detection," CrowdStrike researcher John Prieto wrote in the report. He's right. The baselines don't exist yet. The industry is only now starting to collect the telemetry that would let you define what normal looks like — and attackers are already operating in that gap.
## The Supply Chain Vector Nobody Is Watching Closely Enough
The npm package angle is worth dwelling on. Sandworm_Mode didn't compromise a popular package through a sophisticated supply chain attack — it created 19 malicious packages and waited for developers to pull them in, which they did.
The AI development ecosystem is expanding so fast that package hygiene hasn't kept pace. Developers integrating LLM tooling, MCP servers, and AI assistant extensions are reaching for npm packages the way they've always reached for npm packages: find something that works, install it, move on. The difference now is that the runtime behavior of those packages involves touching sensitive surfaces — API keys, configuration files, CI automation — that didn't used to be part of the package ecosystem's attack surface at all.
This is the supply chain problem getting harder, not easier. When a malicious package in 2019 touched your build environment, you had some detection capability. When a malicious package in 2026 hijacks your Cursor configuration and starts making authenticated LLM API calls, you may have almost none.
## What Defenders Can Actually Do Right Now
The CrowdStrike report is, in their own framing, a gap analysis. Here's how to translate that into defensive action:
Start logging everything the AI toolchain touches. MCP server deployments, AI assistant config writes, LLM API calls with credentials — if you don't have this telemetry, you can't build a baseline. If you can't build a baseline, you can't detect anomalies. This is foundational work that has to start now, before the attacks scale.
Treat your AI assistant extension ecosystem like any other third-party software. That means vendor vetting, a permitted-extensions list, and monitoring for unauthorized additions. The same due diligence you apply to your npm dependency tree should apply to the tools plugged into your developers' coding environments.
Audit npm packages in AI-adjacent projects with extra skepticism. Sandworm_Mode's 19 packages got in because developers weren't looking. Static analysis tools exist; use them on anything touching LLM infrastructure.
Map your MCP server deployments before attackers do. If you're using Model Context Protocol to give your AI assistant access to internal tools and data sources, that's a privileged surface that most organizations haven't yet added to their attack surface inventories.
The hard truth is that for the behaviors CrowdStrike couldn't detect, there's no quick technical fix. That detection gap closes over time as the industry builds baselines — but "over time" means months or years, and attackers who have discovered this vector aren't waiting.
---
## HackWire Analysis
The thing that's easy to miss in coverage of Sandworm_Mode is that the worm itself isn't the story. It's a proof of concept — unsophisticated by the standards of what nation-state actors and well-resourced criminal groups deploy. The story is the detection failure rate CrowdStrike documented, and what that implies for the next two or three years.
Every major shift in attacker tradecraft goes through the same arc: attackers discover a new trusted surface, they exploit the detection gap, defenders spend years building telemetry and baselines, the gap closes. We lived through this with LOtL attacks on Windows system utilities. We're at the very beginning of that cycle again, but on a surface that's evolving faster than Windows ever did.
The AI toolchain isn't just adding one new attack surface — it's adding a dynamic one. MCP servers, AI coding assistants, LLM APIs, CI integration points: these components are changing rapidly, often through automatic updates, and the security tooling is nowhere near caught up. When CrowdStrike says "baselines are still being established across the industry," they're being diplomatic. There are no meaningful baselines yet. The telemetry class is new.
What makes this particularly sharp is the npm supply chain entry point. The most hardened developer environments in the world still have dependency trees that run to hundreds of packages. Adding AI tooling to that stack expands the attack surface in ways that haven't been fully priced in by either security teams or the developers using these tools. The Sandworm_Mode researchers at Socket named it well — what's coming may be much larger than what they found.
— HackWire Editorial
---
## Related Coverage