AI Coding Agent Plugin Subprocess Accessing Credential Stores

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

Detects execution of AI coding assistants or CLI tools (such as Claude, Gemini, Copilot, etc.) that are attempting to access sensitive local configuration, credential, or authentication files, including SSH keys, AWS credentials, and browser cookies.