Version 3

The TeamPCP Mini Shai-Hulud supply chain campaign has grown substantially beyond its initial footprint: named victims now include TanStack, Mistral AI, LiteLLM, Telnyx, and Guardrails AI across 160+ compromised npm and PyPI packages [4][5][6]. The attack has been formally assigned CVE-2026-33634 with a critical CVSS score of 9.4 and is characterized as a self-spreading worm [1][2]. Major security institutions — the Cloud Security Alliance, Datadog Security Labs, Akamai, and GitGuardian — have published independent analyses [11][5][12][13]. Unverified claims that TeamPCP also breached GitHub itself have emerged on social media [10]. Running in parallel, Claude Mythos Preview became the first AI to autonomously clear UK AISI end-to-end offensive cyber ranges [15], and tool poisoning attacks against major AI assistants were confirmed by researchers [16].

The expansion from two named AI-lab victims to five or more, the formal CVE designation at critical severity, and the self-spreading mechanism together confirm this as the most significant supply chain attack targeting the AI developer toolchain on record. Because LiteLLM and Guardrails AI are infrastructure layers used inside many other AI applications — not end-user products — downstream exposure is almost certainly wider than the named victims suggest. The three threads converging in May 2026 (AI as offensive weapon, AI lab infrastructure as attack target, AI assistants as exploitable surfaces) reinforce each other: the same AI capabilities enabling autonomous cyberattacks are being deployed against the toolchains that build those capabilities.

In May 2026, three converging developments forced a reckoning with AI as simultaneously an offensive weapon, a vulnerable target, and an exploitable surface. The most expansive of the three is the TeamPCP supply chain campaign, now formally documented as CVE-2026-33634 (CVSS 9.4) and described by security researchers as one of the most impactful CI/CD supply chain attacks of 2026 [1].

The campaign, carried out under the banner of the Mini Shai-Hulud worm, compromised more than 160 packages across npm and PyPI through a self-spreading mechanism that propagated from one package to its dependents [2]. The initial wave of disclosures named TanStack and two OpenAI employee devices as victims, with code-signing certificates for OpenAI's iOS, macOS, and Windows applications exfiltrated and a mandatory rotation deadline of June 12, 2026 [3]. Subsequent investigation expanded the victim list substantially: Mistral AI, LiteLLM, Telnyx, and Guardrails AI were all identified as compromised [4][5][6]. TeamPCP claimed to be selling access to Mistral AI's internal repositories [7][8][9]. Separately, unverified claims emerged on LinkedIn that GitHub itself had been breached by the same actor [10] — a claim that, if true, would dramatically widen the blast radius, but which had not been officially confirmed as of this writing.

The institutional security response to the campaign has been extensive. The Cloud Security Alliance published a formal research note [11]. Datadog Security Labs traced the LiteLLM compromise in technical detail [5]. Akamai analyzed the Telnyx SDK vector [12]. GitGuardian placed the campaign in a broader 48-hour window during which three separate supply chain attacks hit npm, PyPI, and Docker Hub [13]. ReversingLabs contextualized it within their 4th Annual 2026 Software Supply Chain Security Report [14]. The breadth and speed of this institutional response is itself a signal: LiteLLM and Guardrails AI are dependency layers embedded inside many downstream AI applications, meaning the secondary exposure likely exceeds what the named victims disclose directly.

Two other threads reinforce the supply chain story. First, Claude Mythos Preview — Anthropic's frontier model — became the first AI system to autonomously solve both UK AI Safety Institute end-to-end offensive cyber ranges, including one that had defeated every prior model [15]. Analyst Zvi Mowshowitz called this a genuine step-change: if AI can attack newly deployed code faster than human teams can patch it, the standard deploy-monitor-patch cadence is no longer viable, and every deployment must be pre-tested at the intensity it will face after launch [15]. Second, security researchers confirmed that 'tool poisoning' — embedding hidden data-exfiltration instructions inside AI tool descriptions — works silently against Claude, ChatGPT, Cursor, and other major assistants [16]. The attack is invisible to users, and the stakes rise with the agent ecosystem: active AI agents in Microsoft 365 grew 15x year-over-year, with nearly half of Copilot conversations now involving high-cognition tasks like analysis and decision-making rather than simple summarization [16]. A compromised agent doing cognitive work is a more dangerous target than one doing simple lookup.