Credential File Read Code Generation Request
This detects requests to an AI coding assistant asking it to generate code that opens and reads sensitive credential files, such as /etc/shadow, the Windows SAM database, SSH private keys, cloud metadata endpoints, or browser-stored passwords. These files have essentially no legitimate reason to be read programmatically outside of credential theft.
How the attack works
An attacker frames the request as a normal coding task, asking the AI to write a script or function that reads one of these high-value files. Because the request looks like ordinary code generation, the AI may comply without recognizing the target file as sensitive. The attacker then runs the generated code to extract password hashes, private keys, session cookies, or cloud access tokens. This is a known pattern from automated prompt-injection testing (NVIDIA garak's malwaregen probe).
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 385f9e54-618d-4962-9c40-da8a485c0edd
- Severity
- Critical
Why it matters
If successful, the attacker gets working code to harvest credentials, SSH keys, or cloud secrets, which can lead to account takeover, lateral movement, or full system compromise. The rule only flags the code-generation request itself, not a confirmed breach.
What you can do
- →Review any AI-generated code that touches file paths like /etc/shadow, SAM hives, ~/.ssh keys, or cloud metadata endpoints before running it.
- →Restrict AI coding agents from having filesystem or shell access to these paths in the first place.
- →Set up alerts for AI agent sessions that generate code involving known credential file paths, distinguishing read-only enumeration (e.g., /etc/passwd) from actual secret extraction.
- →Treat security-research or documentation contexts requesting this code as lower risk, but still verify intent before executing generated scripts.
Known benign look-alikes
- sysadmin scripts that legitimately read /etc/passwd for user enumeration (read-only stat)
- cron-job documentation discussing /etc/shadow for password aging policies
- security-research blog posts describing credential-theft techniques defensively
- legitimate ssh-config tooling that parses ~/.ssh/config (not private keys)