A new malware strain, dubbed Sandworm_Mode, is increasingly targeting artificial intelligence (AI) development tools and automated workflows within software development environments. The self-propagating worm, initially discovered by Socket in February 2026, has been observed spreading through code repositories with minimal detection, raising concerns about software supply chain security.
CrowdStrike, which has been analyzing Sandworm_Mode for four months, reports that the malware's capabilities, while extensive, are not entirely unique, bearing similarities to other supply-chain worms like Shai-Hulud and Mini Shai-Hulud. This trend indicates a growing focus by attackers on the AI toolchain.
Sandworm_Mode is designed to steal sensitive data, including credentials, keys, and secrets that provide access to various services and dependencies across the AI development ecosystem. This includes AI assistants, cloud providers, API keys for nine major large language model (LLM) providers, and continuous integration/continuous delivery (CI/CD) pipelines and automated systems used for building, testing, and publishing code.
One of the primary challenges in detecting Sandworm_Mode is its ability to blend into the high volume of daily commands within AI-infused development environments. The malware also employs multi-day delays between initial access and subsequent malicious activity, creating gaps in victim telemetry windows. This pacing makes it difficult for security operations teams to distinguish malicious actions from legitimate dependency pulls and executions by AI agents, which generate significant "noise."
Further complicating detection, Sandworm_Mode has a destructive capability: it automatically destroys compromised environments if it fails to spread or achieve its objectives. CrowdStrike notes that the malware appears "well thought-through and well developed," suggesting a significant investment of time and resources by its creators.
Despite its analysis, CrowdStrike has not definitively determined the intent behind Sandworm_Mode, though it appears designed to establish a strong, long-term foothold. The firm has also not identified the responsible party, speculating it could be a nation-state actor or an e-crime group seeking to sell access to other organizations. CrowdStrike does not believe TeamPCP, a threat group active in open-source software this year, is involved.
The current status of Sandworm_Mode, including whether it remains actively deployed, is unclear. However, CrowdStrike continues to observe recently active malicious supply-chain packages that exhibit similar, albeit technically divergent, patterns. This ongoing activity underscores the evolving threat landscape in AI development and the need for increased vigilance from defenders.
