Prompt the developer's own AI CLI to hunt secrets

AI Posture Secrets Hygiene

When a machine already has an AI coding CLI installed, malware does not
need to carry its own search logic. It can invoke the tool with a prompt
that describes the files it wants — configuration files, credential
stores, dotfiles — and let the agent do the reading. That works because
the CLI has file access by design, because a prompt is not a suspicious
command line, and because an agent walking the filesystem is close to
what the developer's own work looks like, so endpoint controls that
would flag a scripted scan have nothing obvious to match.

Nx s1ngularity (August 2025) is the first well-documented case: the
malicious packages' postinstall ran installed AI CLIs including Claude,
Gemini and Amazon Q with a purpose-built prompt to scan for sensitive
files, targeting GitHub and npm tokens, SSH keys and environment
secrets, then uploaded what it found to public repositories created with
the stolen GitHub token. Mandiant's M-Trends 2026 describes QUIETVAULT
the same way: a credential stealer delivered through a compromised npm
package that checks for local AI command-line tools, runs a predefined
prompt to locate configuration files, collects GitHub and npm tokens and
copies them to a publicly accessible GitHub repository. Mandiant does not
name the package it arrived in.

Distinct from T0140 and T0193, which describe environment variables as
the collection surface: here the search is delegated to a tool that
already has permission to search. Distinct from T0210 and T0221, where
the attacker controls what the agent is told to do through config or
instruction files; here the agent's own installed binary is driven with
an attacker prompt at run time.

Where this idea came from

Public incident / advisory

From the Nx s1ngularity postinstall, which ran installed Claude, Gemini and Amazon Q CLIs with a prompt to scan for sensitive files, and from Mandiant's QUIETVAULT description in M-Trends 2026, which runs a predefined prompt through local AI CLIs and copies GitHub and npm tokens to a public repository. The technique is delegation, not a new collection surface.

Mitigations

None linked yet.

Detections