BeepRAT/MCP: Cloud Credential Exfil via AI Coding Tool Child Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances where common development runtime processes (e.g., node, python, shells) spawn child processes whose command lines contain references to sensitive credential environment variables such as AWS access keys, GitHub tokens, or SSH authentication sockets. This behavior often indicates that a developer or an automated tool is insecurely passing credentials via command-line arguments to subprocesses.