# Codex Agent Credential-to-Egress One-Liner

- **Severity:** High
- **Signature ID:** `7c3f2a9e-5b41-4d86-9f0a-2e6d1b47c3aa`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0050 (Command and Scripting Interpreter), AML.T0025 (Exfiltration via Cyber Means)
- **OWASP:** LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

This detects the moment a compromised AI coding assistant both touches a credential file and immediately tries to send data outward, in the same command. It does not detect the injected instruction itself, only the resulting terminal action.

## How the attack works

An attacker plants a hidden instruction (a prompt injection) somewhere the coding agent will read it, such as a file, ticket, or webpage the agent processes. The agent, running inside a sandbox, is tricked into acting on that instruction. Because the underlying system does not expose the injection or the escape step to monitoring, this rule watches for the one artefact that must appear if the attack succeeds: a single command line that references a credential file or secret string (AWS credentials, SSH keys, Kubernetes config, API keys, etc.) and also invokes a tool that can send data out (curl, wget, scp, netcat, PowerShell web calls, and similar). A second check flags outbound web requests that carry a GitHub, Slack, or Anthropic token, or a PEM key, directly in the URL query string, which is never a legitimate way to send those.

## Why it matters

If missed, an attacker can turn a hijacked coding agent into a channel for stealing cloud credentials, SSH keys, API tokens, or other secrets straight out of the development environment.

## What you can do

- Restrict what files and credential stores the coding agent's sandbox can read, separating secrets from the agent's working directory where possible.
- Require standard authentication flags (like --netrc or -i for SSH) instead of allowing scripts to inline secrets via command substitution, since ad-hoc substitutions are harder to distinguish from exfiltration.
- Review any agent-issued command that both reads a credential path and calls a network tool in the same invocation before assuming it's routine.
- Treat tokens or key material appearing in URL query strings as a red flag and block or log such outbound requests at the network layer.

## Known benign look-alikes

- Agent authenticates to an internal or vendor API by inlining a token it read from ~/.netrc, ~/.config/gh/hosts.yml or ~/.git-credentials into a curl command. Standard flag forms (--netrc, --netrc-file) are filtered; hand-rolled "$(cat ...)" substitutions are intentionally still reported.
- Deployment or backup scripts that scp/rsync with an explicit SSH identity (-i ~/.ssh/id_ed25519, IdentityFile=) — filtered by filter_auth_flag_usage.
- Secret scanners (trufflehog, gitleaks, detect-secrets, semgrep) or grep/find sweeps that name credential paths as search arguments — filtered when the command contains no pipe, since a pipe-free read-only command cannot egress.
- Test suites and fixtures containing the AWS documentation key (AKIAIOSFODNN7EXAMPLE) or obvious placeholders — filtered by filter_placeholder_material and the test-runner filter.
- Documentation or README generation that echoes an example curl one-liner — filtered when run pipe-free via echo/printf.
- Intentional operator-driven transfer of a kubeconfig or docker config to another machine during environment setup. This is genuinely indistinguishable from exfiltration at the command-line layer, which is why the action is report and not block.

## References

- https://openai.com/index/gpt-5-1-codex-max-system-card/
- https://attack.mitre.org/techniques/T1552/001/
- https://attack.mitre.org/techniques/T1567/

---
Source: https://www.netzilo.com/threats/codex-credential-exfil-oneliner