Unverified50% confidenceEventExact time
In August, a virus-infected version of the NX tool was published to NPM, and the malicious code sought out AI agents such as Claude Code and Gemini CLI, asked them to scan for passwords and keys, and enabled Dangerously Skip Permissions; this ultimately led to the leakage of 2,349 keys and tokens, with AI executing the task on 95 machines.
1
Sources
50%
Confidence
Long-term
Relevance
10/23/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedA vulnerability researcher hacker used an AI model to extract the encryption key from Dell S3422 monitor firmware and complete decryption verification in about 15-16 minutes.67% similarUnverifiedSymantec reported on October 15 that the Aoki infostealer has expanded its targets to AI coding tool credentials, including Claude's `.claude.json` and desktop cookies, Codex's `config.toml` and `.env` files, Cursor's local state database, tokens for GitHub Copilot, Gemini, Codeium, JetBrains AI Assistant and Kiro, as well as ChatGPT cookies and AWS credentials.66% similarVerifiedGemini CLI's secret-scanning hook can automatically intercept file write operations that contain hardcoded API keys.66% similarUnverifiedThese malicious packages attempted to steal API keys through a vulnerability that was not patched until more than two months later.65% similarUnverifiedAfter installation on Windows and macOS systems, the malicious npm packages spread infostealers, plant backdoors, and hijack AI agents' outbound traffic.65% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1089655API
curl https://kongchang.com/api/v1/knowledge/claims/1089655MCP
get_claim(id=1089655)