Malware used developers' own AI agents to hunt for their secrets

Attackers who compromised the popular Nx build system in August 2025 used a new technique to steal credentials: a post-install script that invoked whichever AI coding agents were installed on the victim's machine and asked them to find secrets. The campaign became known as s1ngularity.

Malicious versions of nx and several related packages were published to npm on 26 August after a GitHub Actions workflow in the Nx repository was exploited to obtain a publishing token, according to the maintainers' advisory. The packages ran a script that looked for the Claude Code, Gemini CLI and Amazon Q command-line tools and, if found, ran them with a prompt asking for an inventory of wallet files, SSH keys, environment files and tokens on the system. The results were encoded and pushed to a public repository created in the victim's own GitHub account.

Wiz, which analysed the leaked repositories, reported more than a thousand valid GitHub tokens and thousands of other secrets exposed, along with cloud and npm credentials. A second wave of the attack used the stolen GitHub tokens to make private repositories public. Semgrep, Wiz and GitGuardian published indicators and remediation steps.

The Nx maintainers rotated credentials, removed the malicious versions, and required two-factor publishing. Anthropic, Google and Amazon were not implicated in the compromise; their tools were simply present on developer machines and answered the prompt they were given.

The incident was the first widely documented case of malware delegating reconnaissance to local AI agents, and prompted several vendors to add guardrails against agents enumerating credentials.