AI coding tool config access by non-owner process followed by outbound POST

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•7

Detects unauthorized processes reading AI assistant configuration files (e.g., Claude, Cursor, Gemini, VS Code) followed by an outbound network connection from a common scripting or runtime environment (node, python, bun) within 60 seconds, potentially indicating credential or configuration exfiltration.