The reconnaissance loop: what it would take for the agent to run the hunt itself

The starting state

Take an engineering organisation of ordinary size and ordinary habits. Developers install an AI coding assistant as a command-line tool. The tool runs with the developer’s own identity, reads the working tree, and can execute shell commands, because that is what makes it useful. Continuous integration runners execute build steps from installed dependencies, and those runners hold credentials so that pipelines can publish artefacts and comment on pull requests.

Now add the demonstrated event. On 26 August 2025, malicious versions of the Nx build system package reached npm and stayed available for just over five hours. [1] Installing one of them executed a payload that harvested SSH keys, npm tokens and .gitconfig files, and that payload also invoked the AI assistants installed on the machine, using them to search the filesystem for credentials and to push what it found to repositories the attacker controlled. [1] The Nx maintainers confirmed the compromise and traced it to a leaked npm token belonging to a maintainer account. [2] A second wave two days later used the harvested credentials to make private organisation repositories public. [1]

That incident is the foundation. Everything that follows is built on top of it and labelled as construction.

1. Capabilities the scenario requires, and where each is demonstrated

Capability	Status
Executing code from a public package during installation	Demonstrated in the incident
Harvesting credentials from a developer environment	Demonstrated in the incident
Invoking an installed AI assistant non-interactively	Demonstrated in the incident
Locating credentials inside a heterogeneous filesystem	Demonstrated in the incident
Exfiltrating to attacker-controlled infrastructure over ordinary protocols	Demonstrated in the incident
An agent receiving a target list through content it reads during normal work	Hypothesis, with published prompt-injection results as supporting evidence

Five of six capabilities are documented as already exercised in the wild. The sixth sits between two literatures that rarely meet: prompt injection, where the delivery channel is well studied, and supply-chain credential theft, where the target is well understood. The conditional step combines them.

2. Access and permission conditions

The scenario needs five conditions to hold at once. A long-lived token with repository or registry scope must sit in a file the agent can read, with no consent asked each time it runs. The agent must run as the human, so that any action it takes carries the human’s authority and lands in the human’s audit trail. It must read files, issues, dependencies, documentation or tool output that an outside party can influence. The environment must allow outbound connections to arbitrary endpoints, including paste sites and public repository hosts. And something must run the agent with no human present: a build step, a hook, a scheduled job, a watcher. Remove any one of these and the conditional scenario loses its engine. That is the point of writing it down.

3. The causal mechanism

In the conditional scenario, a piece of content the agent meets during routine work contains an instruction. The agent processes it the way it processes any retrieved text, and the instruction sends it looking for credential-shaped material: environment files, key stores, cloud configuration, connection strings in adjacent repositories. Discovery is followed by collection, and collection by transmission to an endpoint the instruction named.

The cleverness of the instruction matters little. What matters is where the capability sits. The demonstrated incident showed that a filesystem-reading assistant is an effective credential search engine in environments nobody has catalogued. Combine that search capability with a delivery channel for the target list, and the attacker no longer has to write per-environment reconnaissance code, which is the most expensive part of a supply-chain campaign.

4. Failure points, ranked by how cheap they are to fix

The failure points reward attention in the order of what they cost to close. A token that expires in fifteen minutes keeps little of its value on a host that has already been compromised. An agent with its own identity, holding its own scoped claims, leaves a clean audit trail and denies the adversary the human’s reach. An agent granted the working tree rather than the home directory meets fewer credential files. A runner that can reach three hosts cannot publish to a repository the attacker selected. An assistant that requires an interactive session cannot be driven by a post-install hook.

5. Prevention and containment

The controls this atlas already carries map onto the failure points with unusual tidiness. Keeping agent authorisation off the agent itself means tool calls and privileged operations are mediated by a party the agent cannot impersonate. Treating agent-run actions as high-impact and gating them behind a human decision breaks the loop at the moment of collection. Registering and constraining which AI tools may run on developer and runner images reduces the installed search surface, and validating and logging agent inputs and outputs turns an unobserved conversation with untrusted content into a reviewable record. Each of those controls is catalogued, with its own scope and limits, in the control entries linked at the foot of this piece. Short-lived credentials issued to workloads, rather than tokens stored beside the code, remove the prize.

Containment deserves a separate thought, because the demonstrated incident compressed the response window badly. The malicious package was live for roughly five hours, and the follow-on abuse of the credentials began two days after that. [1] Organisations that cannot answer “which packages were installed in this window, on which host, and what credentials were present there” in hours cannot contain this class of event at all.

6. Uncertainties

The published record establishes the mechanism, and it leaves several quantities unmeasured. How many harvested credentials produced further access is not established publicly. Whether the assistant-assisted search outperformed the scripted components has not been reported, and the honest reading is that the assistants widened the search where scripting was inconvenient rather than replacing it. How long the credentials remained valid in practice depends on hygiene that varies per organisation, which is exactly the variable that determines the blast radius.

7. Evidence that limits plausibility

Two limits keep this scenario honest.

The first is the shape of the demonstrated abuse. The malware supplied the driving, the target and the exfiltration channel, and the assistants supplied file reading. A scenario in which the agent generates its own objectives out of a piece of untrusted content is a different construction, and its plausibility rests on prompt-injection results rather than on this incident.

The second is the difficulty of self-directed search. An agent that must decide which of ten thousand files look like credentials works against an unbounded problem, and error rates in autonomous multi-step tasks remain high. The conditional scenario becomes realistic in environments where the credentials sit in predictable places, which describes most organisations and none of the careful ones.

Part of Boundary Conditions, the register of cases where AI systems outrun the map. Corrections and counter-evidence go through the door on the register's front page.