Coding Agent Horror Stories: The 29 Million Secret Problem

Summary

Compromised versions of the Nx npm package, dubbed the s1ngularity campaign, used a post-install hook to repurpose installed AI coding agents as credential scanners. Because AI command-line interfaces often run with the developer's full user permissions, the malware invoked tools such as Claude Code, Gemini CLI, and Amazon Q with permission-bypass flags to map sensitive files. GitGuardian findings indicate that AI-assisted code leaks secrets at roughly twice the baseline rate, largely because models ingest live credentials into working contexts. Docker Sandboxes addresses this risk by restricting the execution environment to the project workspace and keeping actual credentials on the host. When sandboxed with sbx, agents receive sentinel placeholders, while an egress proxy injects real secrets into outgoing network requests.

Context

Malicious npm packages exploited installed AI coding agents running with full developer permissions to scan filesystems for credentials, while AI-assisted development doubled the rate of secret leaks across repositories.

Approach / What changed

Docker Sandboxes isolates AI agents to a workspace-only filesystem view, retains credentials on the host, replaces secrets in the agent context with placeholders, and uses an egress proxy to inject actual values into outbound traffic.

Takeaways

• The s1ngularity npm campaign invoked installed AI CLIs with bypass flags like --dangerously-skip-permissions, --yolo, and --trust-all-tools to scan for secrets without user approval.
• According to GitGuardian data from 2025, code generated with AI assistance leaks secrets at approximately double the GitHub-wide baseline rate.
• Docker Sandboxes uses proxy injection at the network boundary, ensuring raw credentials never enter the VM while recording outbound network events in a real-time policy log.

Related reading

• Docker · May 18, 2026

  Coding Agent Horror Stories: The Security Crisis Threatening Developer Infrastructure

  Autonomous AI coding agents increasingly handle developer workflows, but their execution model introduces critical security risks. Operating with the executing user's full permissions, these agents can read ambient secrets, inherit cloud credentials, and run destructive shell commands without human intervention. Documented incidents between October 2024 and February 2026 reveal systemic hazards, including unintentional home directory deletions and increased security vulnerabilities in generated code. To address these vulnerabilities, Docker Sandboxes isolate agent execution within dedicated microVMs, preventing access to the host filesystem and blocking common credential paths by default. Routing changes through Git worktrees and restricting network egress ensures that agent actions remain strictly bounded and reviewable before affecting main branches or production infrastructure.

  Jennifer Kohl

• Docker · Aug 21, 2026