This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
In August 2025, malicious versions of the Nx monorepo tool were published to npm after a CI workflow compromise. The malware included a postinstall script that coerced local AI coding agents (Gemini and Amazon Q) into scanning developer workstations for sensitive credentials and exfiltrating them to a public GitHub repository. This incident represents a significant escalation in supply chain attacks by leveraging AI assistants as automated reconnaissance tools.
Malicious versions of the popular Nx monorepo tool and plugins were reportedly published to npm after attackers compromised its CI workflow. The malware's postinstall script reportedly harvested credentials and exfiltrated data, reportedly weaponizing local AI coding agents such as Claude Code, Gemini, and Amazon q. By invoking unsafe flags, it allegedly coerced the tools into scanning developer machines for sensitive files, marking one of the first known AI-assisted supply chain attacks.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Vulnerabilities that can be exploited in AI systems, software development toolchains, and hardware, resulting in unauthorized access, data and privacy breaches, or system manipulation causing unsafe outputs or behavior.
Also classified as
The AI agents were coerced into scanning the local filesystem to obtain and leak non-public sensitive credentials and keys.
The malware exploited security vulnerabilities in local AI CLI tools by using unsafe flags to bypass guardrails and manipulate the systems into performing unauthorized local file scans.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was initiated and executed by malicious hackers who compromised the Nx repository and explicitly scripted the coercion of local AI agents.
A novel supply chain attack compromised the Nx monorepo tool on npm, deploying malware that coerced local AI coding assistants (Gemini, Amazon Q) into autonomously scanning developer filesystems for credentials and exfiltrating them. While the direct national security impact is minor, it establishes a highly concerning first-of-its-kind precedent for AI-driven local reconnaissance.
The report describes the malware weaponizing local AI coding assistants, turning them into 'autonomous agents' that recursively scanned the filesystem and collected sensitive data without human oversight.
Limited Risk (Level 3): The AI systems involved (Google Gemini and Amazon Q) function as interactive chatbots and coding assistants, which carry transparency obligations under the EU AI Act to ensure users are aware they are interacting with an AI.
The AI systems involved (Gemini and Amazon Q CLI tools) are primarily designed and deployed as developer tools for code generation and technical assistance.
The reports from Snyk and Washington Post provide highly detailed technical breakdowns of the supply chain attack, including the specific malware script (telemetry.js), the targeted AI CLI tools (Gemini, Amazon Q), the exact flags used to bypass guardrails, and the timeline of the compromise. This allows for a very precise classification of the causal and domain taxonomies.
The incident could be interpreted purely as a traditional software supply chain vulnerability (npm package compromise) rather than an AI safety failure, though the novel use of AI agents for local reconnaissance makes the AI-centric classification highly relevant.
Technology
AI CLI dangerous flags enabled
Flags like --yolo allowed bypassing security guardrails entirely.
AI agent over-privilege
Local AI agents had unrestricted access to sensitive local files.
Lack of AI execution isolation
AI CLI tools run with user privileges, exposing sensitive host data.
Data Inputs
Malicious prompt injection
Embedded prompts coerced the AI agent to recursively scan directories.
Minimal prompt variant usage
A simplified prompt bypassed detection by only mapping plaintext file paths.
Human Factors
Overreliance on local AI safety
Developers assumed local AI agents were safe and secure by default.
Unsafe CLI flag usage
Enabling dangerous CLI flags like --trust-all-tools disabled safeguards.
Process and Methods
Inadequate AI security guardrails
Lack of verification for local AI agent execution permissions.
No prompt filtering in AI tools
AI agents executed malicious prompts without verifying the source.
Lack of AI tool provenance
No cryptographic verification of the AI agents and tools being executed.
Management
Rapid adoption of AI tools
Eager deployment of AI assistants without security risk assessments.
Poor oversight of local AI use
IT departments failed to monitor or restrict local AI CLI installations.
Regulatory Environment
Lack of AI safety standards
No regulatory standards governing local AI agent permissions and flags.
No compliance for AI CLIs
Lack of regulatory requirements for securing AI command-line tools.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
