Credential File Theft from Agent Environment

How the attack works

An attacker gets an AI agent to run a tool or follow an instruction that reads a well-known credential file path, such as ~/.aws/credentials or an SSH private key. The agent then makes an outbound network call, which can carry the file's contents to an external destination. Reading the file alone is common in legitimate automation; reading it and immediately reaching out over the network is the suspicious pattern. Stolen credentials of this kind let an attacker move laterally into cloud accounts, servers, or container infrastructure.

Netzilo detection

Why it matters

If successful, the attacker obtains cloud, SSH, or container credentials that can be reused to access other systems, escalating a compromise of the agent into a broader breach of infrastructure the organization controls.

What you can do

• →Restrict which files an AI agent's tools are permitted to read, and deny access to known credential file paths by default.
• →Separate any credential-reading capability from network-access capability so an agent cannot do both in the same task or session.
• →Review agent tool logs for file reads on paths like ~/.aws/credentials, ~/.ssh/, .docker/config.json, or ~/.kube/config followed by outbound requests.
• →Rotate credentials immediately if such a read-then-network-call sequence is confirmed, and treat legitimate cases (e.g., a cloud CLI reading its own config) as exceptions to document, not ignore.

Known benign look-alikes

• SSH configuration management tools operating on the local machine
• Cloud CLI tools reading their own credential files
• DevOps automation scripts that validate credential file permissions without reading their contents
• Security scanning tools that check for the existence of well-known credential files to generate compliance reports

References

• https://agentthreatrule.org/en/rules/ATR-2026-00113

Related threats