AI Coding Assistant Credential Theft for 2026-08-16

Aug 16, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for the credential and config files of AI coding assistants: ~/.claude/.credentials.json and .claude.json (Claude Code), ~/.codex (OpenAI Codex), ~/.gemini (Gemini CLI), Cursor and Copilot. These files hold OAuth tokens and API keys, and scanners walk path traversals to common home directories (root, ubuntu, admin) to find them on servers where the tools run.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files

Observed URIs

Attackers by Country

United States: 3Belgium: 1
United States375.0%
Belgium125.0%

IP Address : ASN : City/Provider

Share on: