Coding Agent Horror Stories: The 29 Million Secret Problem | Docker

Secure, minimal container images for every team, free with enterprise features, if needed.
This is Part 4 of our AI Coding Agent Horror Stories series, a look at real security incidents involving AI coding agents, and how Docker Sandboxes keeps credentials out of an agent’s reach at the execution layer.
In Part 1, we walked through six categories of AI coding agent failures and why they keep happening. The agent runs as you, with your filesystem permissions and your credentials, and nothing sits between the model’s decision and the shell’s execution. Part 2 went deep on the rm -rf ~/ incident. Part 3 moved the same problem into a production cloud environment. The issue keeps credentials in frame but flips the questions around: instead of asking what an agent does with the secrets it holds, we ask what happens to the secrets themselves.
On August 26, 2025, malicious versions of the Nx build package were published to npm. Nx draws roughly four million downloads a week, and the compromised releases carried a post-install hook pointing at a file called telemetry.js:
A post-install hook fires the moment installation finishes, so the payload ran on every machine that pulled the package, with nobody opening a file or reviewing a diff. CI runners were caught the same way, as was anyone whose Nx Console extension checked for a version update during the window. The packages went to npm directly, without provenance. The campaign picked up the name s1ngularity from the public repositories it created to hold what it stole.
telemetry.js then did what credential stealers do, scanning for .env files, SSH private keys, cloud config, npm and GitHub tokens, and wallet keystores. That part is routine. What made s1ngularity worth writing about is the step after it: rather than ship its own scanner, the script checked the machine for an already-installed AI coding agent and handed the job to that.
In this issue, you’ll learn:
Caption: Comic illustrating how a malicious post-install script discovers an installed AI coding agent, invokes it with permission-bypass flags, and uses it to enumerate secrets already within the developer’s reach.
Most credential stealers have to bring their own tooling. They ship a scanner, walk the filesystem themselves, and work from a hardcoded list of the places secrets usually sit. telemetry.js found a cheaper route. It looked for an AI coding agent that was already installed, already signed in, and already permitted to read anything the developer could read, and it put that to work instead.
All three of the agents it looked for a way to run without stopping for approval. Those flags exist for a good reason, since confirming every file read gets tedious once you trust the task you have handed over:
The malware set them itself. The whole selection mechanism is a lookup table with three entries, one for each CLI it knows about:
The script checks which of the three binaries are present, runs whichever it finds, and captures the output. PROMPT is where the instruction lives, and it reads like ordinary work. It tells the agent to search from the home directory down to a depth of eight, match filenames against a list that includes .env, id_rsa, keystore and several wallet formats, and write every absolute path it finds into /tmp/inventory.txt. It also tells the agent not to use sudo, which is the attacker steering clear of a password prompt that would have given the game away.
The division of labour is the part worth sitting with. The agent did the searching, because it was good at it and because nothing stopped it. The malware did the stealing, which is the easy half once you are holding a list of paths. There was no exploit here, no privilege escalation, and no sandbox to escape. The agent was already installed, already authenticated, and already able to read the developer’s entire home directory, and it was invoked with its permission prompt disabled by a flag.
GitGuardian’s State of Secrets Sprawl 2026 found roughly 28.65 million new hardcoded secrets pushed to public GitHub in 2025, up 34% year over year. Buried in that total is the number that matters for us: the same report puts the secret leak rate in AI-assisted code at roughly double the GitHub-wide baseline. Code written with an agent leaks credentials at about twice the rate of code written without one.
The mechanism is straightforward. An agent asked to wire up an API integration will read the project’s .env to determine what the key is called, at which point a live credential sits in the model’s working context. From there it can reach a generated config, a test fixture, or a commit, because nothing in that step distinguishes the real value from the placeholder that belonged there. A developer reviewing the same change has a moment to catch it. An agent generating and committing at machine speed does not, and in many cases neither does a reviewer.
Both stories run on the same property. An agent on your machine runs as you, with your filesystem access and your credentials, and there is no narrower identity for it to fall back to. That is what lets a live key drift out of .env and into a commit, and it is the same thing that let a poisoned package point an already-authorised agent at the home directory. One is an accident and the other is an attack, but they need identical conditions to work.
Caption: Diagram showing how a post-install script borrows an already-authorised AI CLI to read credentials the developer left within reach.
Here is how the incident unfolds, step by step.
A developer or a CI runner pulls a poisoned Nx version, usually as a transitive dependency several levels down. Nothing about the command looks unusual, and the post-install hook shown earlier does the rest. The payload checks the platform before anything else and exits on Windows, so the machines at risk were macOS and Linux.
The script walks the common locations for credentials, which on an ordinary workstation is exactly where working credentials