AI Coding Assistant Credential Theft for 2026-07-12

Jul 12, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for the credential and config files of AI coding assistants: ~/.claude/.credentials.json and .claude.json (Claude Code), ~/.codex (OpenAI Codex), ~/.gemini (Gemini CLI), Cursor and Copilot. These files hold OAuth tokens and API keys, and scanners walk path traversals to common home directories (root, ubuntu, admin) to find them on servers where the tools run.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files

Observed URIs

Attackers by Country

The Netherlands: 4United States: 2
The Netherlands466.7%
United States233.3%

IP Address : ASN : City/Provider

Share on: