AI Coding Assistant Credential Theft for 2026-10-02

Oct 02, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for the credential and config files of AI coding assistants: ~/.claude/.credentials.json and .claude.json (Claude Code), ~/.codex (OpenAI Codex), ~/.gemini (Gemini CLI), Cursor and Copilot. These files hold OAuth tokens and API keys, and scanners walk path traversals to common home directories (root, ubuntu, admin) to find them on servers where the tools run.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files

Observed URIs

Attackers by Country

Belgium: 3Luxembourg: 1The Netherlands: 1
Belgium360.0%
Luxembourg120.0%
The Netherlands120.0%

IP Address : ASN : City/Provider

Share on: