On August 26, 2025, attackers compromised an npm publishing token for the Nx build system through a vulnerable GitHub Action and pushed malicious versions of nx and several @nx/* packages. The postinstall script didn't just grep the filesystem for secrets — it checked whether the host had a locally installed AI coding CLI, and if so, invoked it non-interactively with a prompt opening with "you are an authorized penetration testing agent" and instructing it to recursively search $HOME and config directories for anything that looked like a credential.
What the source says
Security firm Wiz's post-incident analysis found roughly half of the affected machines had one of these CLIs installed — mostly Claude, with some Gemini CLI and a few Amazon Q instances — and traced multiple prompt iterations across the attack's package versions, evidence the attacker was actively tuning the jailbreak framing. Even so, AI-assisted exfiltration succeeded in under a quarter of attempts: refusals, workspace restrictions and configuration mismatches blocked most of it. Where it worked, the AI-driven search pulled under 100 unique still-valid secrets out of roughly 20,000 scanned files across 225 compromised developer accounts — what Wiz calls the first documented case of a locally installed AI coding CLI being weaponized as the search tool inside a live supply-chain attack.
That AI-assisted slice was a minority of the wider campaign. The malware's own non-AI file scan leaked secrets from over 1,700 users in its first phase, and a later phase exposed 6,700+ private repositories from 480+ compromised accounts. Stolen data was base64-encoded and pushed to public GitHub repos named s1ngularity-repository before GitHub pulled them down — by then, Wiz found almost 90% of leaked GitHub tokens and over 40% of leaked npm tokens were still valid.
What it doesn't establish
Wiz's writeup doesn't give a full breakdown of exactly which CLI versions refused versus complied, or whether the refusal rate differed meaningfully between Claude, Gemini CLI and Amazon Q individually — the "under a quarter" success figure is reported in aggregate. It's also a postinstall-script attack, not a case of an agent being tricked mid-task by a user-supplied prompt in an IDE; the exposure here required an unattended, non-interactive invocation with no real user present at all.
Why it's still worth logging
Most of the coverage of this incident understandably focused on the npm supply-chain mechanics — a compromised CI token, a malicious postinstall hook, over a thousand leaked secrets. The detail that's easy to lose is that the attacker treated "there might be an AI coding CLI sitting on this machine with filesystem access" as a feature to probe for, the same way older malware probes for a crypto wallet file or a cloud credentials directory. It mostly didn't work — most attempts were refused — but it worked often enough, and the attacker kept iterating the prompt to make it work more. That's a different threat model than "a user got socially engineered." Nobody has to be fooled; the CLI just has to be sitting there, authenticated, when something else on the box decides to use it.
Full record, severity scoring, and source: https://www.stupidllm.com/incident/STUPID-2026-0152/
Top comments (0)