Reference implementation Data compiled from public sources as of 2026-10-26. Not an assessment, certification or recommendation. Confirm current status with the vendor and the issuing body.
AgentDossier · AI Agent Registry Find agents you can actually trust - public or inside your enterprise.

Traces / TR-2026-008

agent was the attacker · real-world incident · unreviewed

s1ngularity: npm-borne malware drives developers' own AI CLIs (Claude, Gemini, Q) to hunt for secrets

Malicious versions of the Nx build package shipped a postinstall script that, on developer machines and in CI, invoked locally installed AI command-line agents — Claude, Gemini and Amazon Q — with permission-skipping flags (--dangerously-skip-permissions, --yolo, --trust-all-tools) and prompted them to enumerate the filesystem for wallets, keystores, .env files and SSH keys. Wiz observed the AI-assisted reconnaissance succeed in hundreds of cases (provider guardrails sometimes intervened). Harvested tokens were base64-encoded into attacker-created public GitHub repos; a second wave used leaked tokens to flip victims' private repositories public. This is a trace of AI agents turned into the attacker's reconnaissance tool.

Export STIX 2.1 Export JSON Request a correction (GitHub issue)

Timeline

2025-08-26 Malicious Nx versions published to npm; the postinstall script prompts installed AI CLIs to find secrets · Wiz T2
2025-08-27 GitHub disables the s1ngularity exfiltration repositories (~8-hour exposure window) · Wiz T2
2025-08-28 A second wave uses leaked tokens to make victims' private repositories public (400+ orgs, 5,500+ repos) · Wiz T2

What defenders can take from it

  1. A capable AI CLI on a developer's machine becomes an attack tool once code can invoke it — treat permission-skipping flags as a privilege, not a convenience.
  2. Provider guardrails refused some of the malicious prompts; that layer is worth keeping, but it is probabilistic, not a control.
  3. Secrets reachable to a shell are reachable to an agent the shell can launch; scope what a developer agent is allowed to read.

The maintainer's reading of the public reports, not advice specific to your deployment.

Sources · 2

Links re-checked 2026-10-26 by the weekly refresh. A link that moved or stopped answering is flagged above; it is not a change to the record.

Compiled from the public sources above, as reported. Not an attribution, a finding of fault or a legal conclusion; figures are those stated by the sources. One event, as of its sources' dates.