Coding Agent Horror Stories: The 29 Million Secret Problem
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A malicious version of the Nx npm package (the s1ngularity attack) used a post-install hook to detect installed AI coding CLIs (Claude Code, Gemini CLI, Amazon Q) and invoke them with permission-bypass flags to inventory credentials across the developer's home directory. The stolen data — SSH keys, .env files, cloud configs, GitHub tokens — was exfiltrated to public repositories, with 2,349 secrets stolen across 1,079 repos. The root cause is that AI agents run with the developer's full filesystem access. Docker Sandboxes mitigates this by isolating agents in microVMs with workspace-only filesystem access and proxy-injected credentials that never enter the VM, so a compromised dependency finds nothing to harvest.
Table of contents
Today’s Horror Story: The Agent That Read Everyone’s KeysThe ProblemThe Scale of the ProblemTechnical Breakdown: How an npm install Becomes a Credential LeakThe ImpactHow Docker Sandboxes Removes the Secrets From ReachWhat This Looks Like in PracticeBest Practices for Keeping Secrets Out of an Agent’s ReachTake ActionConclusion64.4K Impressions5 Comments