AI Credential File Access (IronWorm)

Ethan Andrews@eandrews

•updated Jun 4, 2026•14•0•34

Detects anomalous processes targeting modern AI developer credential files and configuration files for tools like Claude, Gemini, and Cursor, a behavior exhibited by IronWorm.