Coding Agent Horror Stories: The 29 Million Secret Problem

Summary

Compromised versions of the Nx npm package, dubbed the s1ngularity campaign, used a post-install hook to repurpose installed AI coding agents as credential scanners. Because AI command-line interfaces often run with the developer's full user permissions, the malware invoked tools such as Claude Code, Gemini CLI, and Amazon Q with permission-bypass flags to map sensitive files. GitGuardian findings indicate that AI-assisted code leaks secrets at roughly twice the baseline rate, largely because models ingest live credentials into working contexts. Docker Sandboxes addresses this risk by restricting the execution environment to the project workspace and keeping actual credentials on the host. When sandboxed with sbx, agents receive sentinel placeholders, while an egress proxy injects real secrets into outgoing network requests.

Takeaways

1. 1

   The s1ngularity npm campaign invoked installed AI CLIs with bypass flags like --dangerously-skip-permissions, --yolo, and --trust-all-tools to scan for secrets without user approval.

2. 2

   According to GitGuardian data from 2025, code generated with AI assistance leaks secrets at approximately double the GitHub-wide baseline rate.

3. 3

   Docker Sandboxes uses proxy injection at the network boundary, ensuring raw credentials never enter the VM while recording outbound network events in a real-time policy log.