Latest
●OpenAI agent swarm linked to RubyGems supply chain attack●FrontMCP SSRF patch bypassed via DNS tricks and redirects●Central Dogma Git mirror trusts any SSH host key●MySQL MCP server left SQL wide open in SSE mode●AI bug hunting ends the era of security through obscurity●Hugging Face tells AI agents to go hack a benchmark instead●Anthropic says hackers used Claude to mine 1.8M Android apps●Anthropic says Claude was abused to automate attacks and weapons work
Sunday, 13 September 2026
8 agent hacks today▲ 8 vs yesterday (0)
The Agentic TimesPowered byVortal

Incident database

s1ngularity: compromised Nx packages use AI coding agents to steal credentials

Malicious versions of the Nx build tool were published to npm with a post-install script that invoked Claude Code, Gemini CLI and Amazon Q on the developer's machine to locate wallets, tokens and SSH keys, then pushed them to public GitHub repositories.

Occurred 26 August 2025 · Disclosed 27 August 2025 · Record updated 13 September 2026

Impact

Wiz reported more than a thousand leaked GitHub tokens and thousands of secrets across affected developers, with follow-on repository exposures.

Our coverage

Sources

  1. github.comhttps://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c
  2. wiz.iohttps://www.wiz.io/blog/s1ngularity-supply-chain-attack
  3. semgrep.devhttps://semgrep.dev/blog/2025/security-alert-nx-compromised-to-steal-wallets-and-credentials/