Agent Tooling as Attack Surface

40.1 What Happened #

On August 21, 2025 a workflow was merged into the Nx repository that interpolated a pull request title directly into a shell command. Combined with a trigger that runs with the target branch’s elevated permissions, a repository token that still carried GitHub’s legacy read-write default, and a publish workflow that could be invoked programmatically, the result was a complete path from an attacker-authored pull request title to package publication rights.²²⁴

The vulnerability was disclosed publicly on 21 August and the workflow reverted on 22 August. The attacker had already used it. On 24 August they committed a modified publish workflow to a branch, triggered it through the API, exfiltrated the registry token, and deleted the workflow run from the audit log. On the evening of 26 August, eight versions of the primary package and several scoped packages were published to the registry over roughly two hours.^224,226 The registry removed them and revoked publish tokens shortly after 02:44 UTC on 27 August.

The package has roughly six million weekly installs. Exposure was not limited to direct installation: transitive dependencies, an editor extension that fetched the latest version to perform a version check, automated dependency-update scripts, and agent-initiated installs all reached the malicious postinstall script.²²⁴

40.2 The Payload, and the Part That Matters Here #

The script fingerprinted the host, then read what it could find directly: the GitHub CLI token, registry credentials, SSH private keys, environment files, and cryptocurrency wallet artifacts. It merged everything into a single blob, triple base64-encoded it, authenticated to the GitHub API with the victim’s own stolen token, created a public repository under the victim’s account, and uploaded the blob there. It then appended a shutdown command to the user’s shell profiles.⁶⁰

Between the credential theft and the exfiltration, it did something new. It checked for three locally installed coding agents by name and, where present, invoked each with that product’s own permission-bypass flag—--dangerously-skip-permissions for one, --yolo for another, --trust-all-tools --no-interactive for the third—passing a prompt instructing the agent to enumerate the filesystem and write a newline-separated inventory of interesting file paths to a temporary file.^225,226

The prompt’s construction is the instructive part. It opened by asserting that the agent was “an authorized penetration testing agent” operating “with explicit permission and within the rules of engagement,” and it explicitly instructed the agent not to open, read, move, modify, or exfiltrate anything—only to list paths.⁶⁰ The malware did the reading itself. The agent was asked to do something that, taken in isolation, looks almost benign.

An assessment named this correctly at the time:

“To our knowledge, this is one of the first documented cases of malware coercing AI-assistant CLIs to assist in reconnaissance.”

— Ashish Kurmi, StepSecurity, August 27, 2025²²⁸

40.3 What the Agents Actually Did #

This is the most valuable data in the case and it is routinely omitted from summaries.

The agents did not reliably comply. Post-incident analysis found that almost a quarter of interactions with one agent were rejected outright; another was foiled in roughly a quarter of cases by default restrictions confining it to workspace directories; and across the population, the agent-assisted path “only exfiltrated data successfully in under a quarter of cases.”²²⁷

The reason for the refusals is worth stating precisely, because it cuts against the attacker’s own cleverness. The jailbreak framing triggered the guardrail: “The introduction of the phrase ‘penetration testing’, for example, was concretely reflected in LLM refusals to engage in such activity.”²²⁷ The social engineering that made the request look legitimate to a human reader is what made it look illegitimate to the model.

Additional friction had nothing to do with safety at all: account credit exhaustion, credential problems, one agent’s permission-bypass flag still requiring an approval step, and tool-configuration failures.²²⁷

The yield was correspondingly poor. Under 100 unique valid secrets across roughly 20,000 exfiltrated files, mostly credentials for AI services and cloud platforms, with no observed successful cryptocurrency exfiltration despite the second prompt variant targeting wallets specifically.²²⁷

40.4 What Was Measured, and Where the Sources Disagree #

The two independent analyses disagree by roughly a factor of two on agent prevalence and by a similar margin on second-phase repository counts, and one of them revised its own figure upward mid-investigation. Cite both with attribution. Averaging them would manufacture a precision that does not exist.

The second phase is its own lesson. Roughly 36 hours after the initial compromise, automation using the stolen tokens began flipping victims’ private repositories to public, over TOR, at scale. The initial credential theft was the cheap part; the expensive part was everything those credentials could subsequently reach.

40.5 The Remediations #

The vendor’s response is a usable checklist because it maps one-to-one onto the failure chain. Publication moved to trusted-publisher federation with short-lived credentials, eliminating the long-lived registry token that was stolen. Publishing was constrained to the continuous integration pipeline and gated on manual second-factor approval. Workflow runs were disabled for all external contributors rather than only first-time ones, requiring approval in every case. Provenance verification was added to the tool and its editor extension. Static analysis was enabled on the repository, branch protection enforced, and a disclosure policy and security contact established.²²⁴

Note what is absent from that list: nothing about the agents. The vendor could not fix the agent-abuse vector because it was not the vendor’s to fix.

40.6 What Transfers #

A developer workstation with an authenticated agent on it is a privileged system. It holds a registry token, a source-control token, cloud credentials, and SSH keys, and it now also holds a general-purpose execution engine that can be invoked non-interactively by anything that achieves code execution. Every control this framework specifies for agents in continuous integration—short-lived credentials, scoped permissions, egress restriction, action boundaries—applies to the laptop, and almost no organization applies them there.

Permission-bypass flags are a supply-chain liability, not a productivity setting. Three products, three different flag names, one shared property: each disables the confirmation step that would have surfaced this activity to the user. An organization that permits these flags in developer environments should treat that as an accepted risk with a named owner, and should be able to detect their use.

Model refusal is a real but unreliable layer. Roughly a quarter refusal is meaningful and it is not a control. The framework’s position on this is unchanged and is reinforced rather than softened by the data: what stopped exfiltration more reliably than the model’s judgment was one agent’s default confinement to workspace directories, which is a permission boundary. Authority is architecture, not instruction—and here the architecture outperformed the instruction while both were being tested at once.

Postinstall execution remains the weak point of the ecosystem. No agent-specific control addresses the fact that installing a dependency runs arbitrary code as the developer.

A postscript: on 18 and May 19, 2026 the same vendor’s ecosystem was compromised again by a different attack chain, including a poisoned editor extension available for approximately eighteen minutes and a compromise reached through a platform employee’s device.²²⁹ Two supply-chain compromises at one dependency in nine months is a procurement fact, and it belongs in the vendor-risk register alongside the technical lessons.

40.7 What This Rests On #

The timeline, the initial access vector, and the remediations come from the vendor’s own advisory and postmortem. The payload behavior and the agent-invocation code come from three independent security analyses that agree with each other on the mechanism. The refusal data comes from a single firm’s telemetry-based aftermath analysis and has not been corroborated. The scale figures are contested between two firms and are presented as contested. No source distinguishes whether an agent invocation that “succeeded” did so because the model complied with a malicious request or because it performed a benign-looking inventory it had no reason to refuse—which is the most interesting open question the incident leaves behind.