Coding Agent Horror Stories: The 29 Million Secret Problem

Learn how AI coding agents can expose credentials in supply chain attacks and how Docker Sandboxes keep secrets out of an agent's reach. This is Part 4 of our AI Coding Agent Horror Stories series, a look at real security incidents involving AI coding agents, and how Docker Sandboxes keeps credentials out of an agent’s reach at the execution layer. In Part 1 , we walked through six categories of AI coding agent failures and why they keep happening. The agent runs as you, with your filesystem permissions and your credentials, and nothing sits between the model’s decision and the shell’s execution. Part 2 went deep on the rm -rf ~/ incident. Part 3 moved the same problem into a production cloud environment. The issue keeps credentials in frame but flips the questions around: instead of asking what an agent does with the secrets it holds, we ask what happens to the secrets themselves. Today’s Horror Story: The Agent That Read Everyone’s Keys On August 26, 2025, malicious versions of the Nx build package were published to npm . Nx draws roughly four million downloads a week, and the compromised releases carried a post-install hook pointing at a file called telemetry.js : cat package.json { "name": "nx", "version": "21.5.0", "private": false, "description": "The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.", "repository": { "type": "git", "url": "https://github.com/nrwl/nx.git", "directory": "packages/nx" }, ... "main": "./bin/nx.js", "types": "./bin/nx.d.ts", "type": "commonjs", "scripts": { "postinstall": "node telemetry.js" } } A post-install hook fires the moment installation finishes, so the payload ran on every machine that pulled the package,

Learn how AI coding agents can expose credentials in supply chain attacks and how Docker Sandboxes keep secrets out of an agent's reach. This is Part 4 of our AI Coding Agent Horror Stories series, a look at real security incidents involving AI coding agents, and how Docker Sandboxes keeps credentials out of an agent’s reach at the execution layer. In Part 1 , we walked through six categories of AI coding agent failures and why they keep happening. The agent runs as you, with your filesystem permissions and your credentials, and nothing sits between the model’s decision and the shell’s execution. Part 2 went deep on the rm -rf ~/ incident. Part 3 moved the same problem into a production cloud environment. The issue keeps credentials in frame but flips the questions around: instead of asking what an agent does with the secrets it holds, we ask what happens to the secrets themselves. Today’s Horror Story: The Agent That Read Everyone’s Keys On August 26, 2025, malicious versions of the Nx build package were published to npm . Nx draws roughly four million downloads a week, and the compromised releases carried a post-install hook pointing at a file called telemetry.js : cat package.json { "name": "nx", "version": "21.5.0", "private": false, "description": "The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.", "repository": { "type": "git", "url": "https://github.com/nrwl/nx.git", "directory": "packages/nx" }, ... "main": "./bin/nx.js", "types": "./bin/nx.d.ts", "type": "commonjs", "scripts": { "postinstall": "node telemetry.js" } } A post-install hook fires the moment installation finishes, so the payload ran on every machine that pulled the package, with nobody opening a file or reviewing a diff. CI runners were caught the same way, as was anyone whose Nx Console extension checked for a version update during the window. The packages went to npm directly, without provenance. The campaign picked up the name s1ngularity from the public repositories it created to hold what it stole. telemetry.js then did what credential stealers do, scanning for .env files, SSH private keys, cloud config, npm and GitHub tokens, and wallet keystores. That part is routine. What made s1ngularity worth writing about is the step after it: rather than ship its own scanner, the script checked the machine for an already-installed AI coding agent and handed the job to that. In this issue, you’ll learn: How a poisoned npm package turned installed AI CLIs into credential scanners Why --dangerously-skip-permissions and its equivalents are the whole attack Why AI-assisted code leaks secrets at roughly twice the baseline rate How Docker Sandboxes removes the credentials from the agent’s reach entirely Caption: Comic illustrating how a malicious post-install script discovers an installed AI coding agent, invokes it with permission-bypass flags, and uses it to enumerate secrets already within the developer’s reach. The Problem Most credential stealers have to bring their own tooling. They ship a scanner, walk the filesystem themselves, and work from a hardcoded list of the places secrets usually sit. telemetry.js found a cheaper route. It looked for an AI coding agent that was already installed, already signed in, and already permitted to read anything the developer could read, and it put that to work instead. All three of the agents it looked for a way to run without stopping for approval. Those flags exist for a good reason, since confirming every file read gets tedious once you trust the task you have handed over: --dangerously-skip-permissions on Claude Code --yolo on Gemini CLI --trust-all-tools on Amazon Q The malware set them itself. The whole selection mechanism is a lookup table with three entries, one for each CLI it knows about: const cliChecks = { claude: { cmd: 'claude', args: ['--dangerously-skip-permissions', '-p', PROMPT] }, gemini: { cmd: 'gemini', args: ['--yolo', '-p', PROMPT] }, q: { cmd: 'q', args: ['chat', '--trust-all-tools', '--no-interactive', PROMPT] } }; The script checks which of the three binaries are present, runs whichever it finds, and captures the output. PROMPT is where the instruction lives, and it reads like ordinary work. It tells the agent to search from the home directory down to a depth of eight, match filenames against a list that includes .env , id_rsa , keystore and several wallet formats, and write every absolute path it finds into /tmp/inventory.txt . It also tells the agent not to use sudo, which is the attacker steering clear of a password prompt that would have given the game away. The division of labour is the part worth sitting with. The agent did the searching, because it was good at it and because nothing stopped it. The malware did the stealing, which is the easy half once you are holding a list of paths. There was no exploit here, no privilege escalation, and no sandbox to escape. The agent was already installed, already authenticated, and already able to read the developer’s entire home directory, and it was invoked with its permission prompt disabled by a flag. The Scale of the Problem GitGuardian’s State of Secrets Sprawl 2026 found roughly 28.65 million new hardcoded secrets pushed to public GitHub in 2025, up 34% year over year. Buried in that total is the number that matters for us: the same report puts the secret leak rate in AI-assisted code at roughly double the GitHub-wide baseline. Code written with an agent leaks credentials at about twice the rate of code written without one. The mechanism is straig

Learn how AI coding agents can expose credentials in supply chain attacks and how Docker Sandboxes keep secrets out of an agent's reach. This is Part 4 of our AI Coding Agent Horror Stories series, a look at real security incidents involving AI coding agents, and how Docker Sandboxes keeps credentials out of an agent’s reach at the execution layer. In Part 1 , we walked through six categories of AI coding agent failures and why they keep happening. The agent runs as you, with your filesystem permissions and your credentials, and nothing sits between the model’s decision and the shell’s execution. Part 2 went deep on the rm -rf ~/ incident. Part 3 moved the same problem into a production cloud environment. The issue keeps credentials in frame but flips the questions around: instead of asking what an agent does with the secrets it holds, we ask what happens to the secrets themselves. Today’s Horror Story: The Agent That Read Everyone’s Keys On August 26, 2025, malicious versions of the Nx build package were published to npm . Nx draws roughly four million downloads a week, and the compromised releases carried a post-install hook pointing at a file called telemetry.js : cat package.json { "name": "nx", "version": "21.5.0", "private": false, "description": "The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.", "repository": { "type": "git", "url": "https://github.com/nrwl/nx.git", "directory": "packages/nx" }, ... "main": "./bin/nx.js", "types": "./bin/nx.d.ts", "type": "commonjs", "scripts": { "postinstall": "node telemetry.js" } } A post-install hook fires the moment installation finishes, so the payload ran on every machine that pulled the package, with nobody opening a file or reviewing a diff. CI runners were caught the same way, as was anyone whose Nx Console extension checked for a version update during the window. The packages went to npm directly, without provenance. The campaign picked up the name s1ngularity from the public repositories it created to hold what it stole. telemetry.js then did what credential stealers do, scanning for .env files, SSH private keys, cloud config, npm and GitHub tokens, and wallet keystores. That part is routine. What made s1ngularity worth writing about is the step after it: rather than ship its own scanner, the script checked the machine for an already-installed AI coding agent and handed the job to that. In this issue, you’ll learn: How a poisoned npm package turned installed AI CLIs into credential scanners Why --dangerously-skip-permissions and its equivalents are the whole attack Why AI-assisted code leaks secrets at roughly twice the baseline rate How Docker Sandboxes removes the credentials from the agent’s reach entirely Caption: Comic illustrating how a malicious post-install script discovers an installed AI coding agent, invokes it with permission-bypass flags, and uses it to enumerate secrets already within the developer’s reach. The Problem Most credential stealers have to bring their own tooling. They ship a scanner, walk the filesystem themselves, and work from a hardcoded list of the places secrets usually sit. telemetry.js found a cheaper route. It looked for an AI coding agent that was already installed, already signed in, and already permitted to read anything the developer could read, and it put that to work instead. All three of the agents it looked for a way to run without stopping for approval. Those flags exist for a good reason, since confirming every file read gets tedious once you trust the task you have handed over: --dangerously-skip-permissions on Claude Code --yolo on Gemini CLI --trust-all-tools on Amazon Q The malware set them itself. The whole selection mechanism is a lookup table with three entries, one for each CLI it knows about: const cliChecks = { claude: { cmd: 'claude', args: ['--dangerously-skip-permissions', '-p', PROMPT] }, gemini: { cmd: 'gemini', args: ['--yolo', '-p', PROMPT] }, q: { cmd: 'q', args: ['chat', '--trust-all-tools', '--no-interactive', PROMPT] } }; The script checks which of the three binaries are present, runs whichever it finds, and captures the output. PROMPT is where the instruction lives, and it reads like ordinary work. It tells the agent to search from the home directory down to a depth of eight, match filenames against a list that includes .env , id_rsa , keystore and several wallet formats, and write every absolute path it finds into /tmp/inventory.txt . It also tells the agent not to use sudo, which is the attacker steering clear of a password prompt that would have given the game away. The division of labour is the part worth sitting with. The agent did the searching, because it was good at it and because nothing stopped it. The malware did the stealing, which is the easy half once you are holding a list of paths. There was no exploit here, no privilege escalation, and no sandbox to escape. The agent was already installed, already authenticated, and already able to read the developer’s entire home directory, and it was invoked with its permission prompt disabled by a flag. The Scale of the Problem GitGuardian’s State of Secrets Sprawl 2026 found roughly 28.65 million new hardcoded secrets pushed to public GitHub in 2025, up 34% year over year. Buried in that total is the number that matters for us: the same report puts the secret leak rate in AI-assisted code at roughly double the GitHub-wide baseline. Code written with an agent leaks credentials at about twice the rate of code written without one. The mechanism is straig