AI Coding Assistant Credential Theft for 2026-07-31

Jul 31, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for the credential and config files of AI coding assistants: ~/.claude/.credentials.json and .claude.json (Claude Code), ~/.codex (OpenAI Codex), ~/.gemini (Gemini CLI), Cursor and Copilot. These files hold OAuth tokens and API keys, and scanners walk path traversals to common home directories (root, ubuntu, admin) to find them on servers where the tools run.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files

Observed URIs

Attackers by Country

United States: 1Belgium: 1
United States150.0%
Belgium150.0%

IP Address : ASN : City/Provider

Share on: