Credential theft in AI agent harness traces demands new monitoring

At a glance

What this is: This analysis shows how credential theft in AI agent harness traces can be detected by flagging off-tree file reads and other anomalous tool calls.

Why it matters: It matters because AI coding agents inherit developer credentials and config files, so IAM, PAM, and NHI teams need telemetry that can distinguish normal tool use from credential-harvesting behavior.

By the numbers:

• In May 2026, a malicious VS Code extension ran on roughly 6,000 developer machines in 18 minutes before it was caught.
• The earlier attack reached more than 400 malicious versions across 172 packages by abusing stolen OIDC tokens from CI pipelines.

👉 Read Arize's analysis of how agent traces can detect credential theft

Context

AI agent harness traces are the structured records of tool calls made by coding agents as they read files, run commands, and touch local resources. In this article, credential theft is the core problem because malicious extensions and supply-chain payloads are reaching into developer workspaces for AWS keys, GitHub tokens, SSH keys, and agent configuration files.

The governance gap is that many teams still treat the harness as a trusted execution layer rather than a place where NHI abuse becomes visible. Once credentials and config files live on disk beside the agent, trace data can expose off-tree reads, but only if teams deliberately instrument for them and keep the telemetry long enough to investigate.

This is not just an application security concern. It sits at the intersection of NHI governance, developer tooling, and identity telemetry, which means IAM, PAM, and security engineering teams need a shared view of what the agent is allowed to touch and when.

Key questions

Q: What breaks when AI agents can read files outside their workspace?

A: Off-tree reads break the assumption that an agent only touches project data. Once a tool can reach home-directory credentials, config files, or system paths, the trace trail becomes a credential-theft signal and the agent can expose NHI secrets that were never meant to be available in-session.

Q: Why do AI assistants create more credential risk than traditional developer tools?

A: They often aggregate access to many external services in one workflow, then persist those credentials in predictable local files or sync them into shared environments. That concentration increases blast radius. A single compromise can expose code repositories, chat, cloud projects, and databases instead of just one application boundary.

Q: What do security teams get wrong about logging agent activity?

A: Teams often assume that detailed logs equal control. In reality, logs only prove what happened, not whether the action should have been allowed. For agentic workflows, the important question is whether policy evaluated the request before execution and whether the control point could narrow or stop the action in real time.

Q: How should teams investigate suspected credential theft in an agent harness?

A: Start with the agent session, identify off-tree reads, and correlate those file paths with endpoint, package, and identity logs. Then check whether malicious code entered through a dependency, an editor extension, or a persistent config hook so you can trace the abuse path end to end.

Technical breakdown

How off-tree file reads expose credential theft in agent traces

An off-tree read is a file access outside the agent’s working project, such as a home directory credential store or system config path. In the article’s example, the monitor classifies each tool call path and counts reads that land outside the workspace. That works because ordinary agent sessions typically stay inside project boundaries, while credential-harvesting behavior reaches into locations like ~/.aws/credentials, ~/.ssh/id_rsa, or ~/.claude/anthropic_api_key. The signal is simple, but it is powerful because it rides on telemetry the agent already emits.

Practical implication: instrument file paths at the tool-call layer and alert on any off-tree read, not just on obvious exfiltration events.

Why the harness itself is part of the attack surface

An agent harness loads tools, dispatches calls, and fires lifecycle hooks on local events such as opening an editor or starting a session. The article’s central point is that the harness checks none of this for origin, so once malicious code or a hooked config file lands on disk, the harness will happily execute it on the next run. That makes the harness more than orchestration code. It becomes an identity and trust boundary problem because the agent executes whatever is present without independently validating provenance or purpose.

Practical implication: treat harness configuration, startup hooks, and dependency provenance as governed identity assets, not just developer conveniences.

Why trace-based detection complements host and install-time controls

Trace monitoring can detect credential-harvesting that occurs through instrumented agent tools, but it will miss payloads that execute outside the agent layer or reach disk before tracing begins. The article is explicit that the Nx Console compromise and the hooked config-file attack used different layers of the stack. That means one control cannot cover the full chain. The effective pattern is layered visibility across installation, host telemetry, and agent traces, with honeytokens adding a high-confidence signal across all three layers.

Practical implication: combine trace monitors with dependency pinning, config version control, and honeytokens so a single bypass does not blind the programme.

Threat narrative

Attacker objective: The attacker wanted developer credentials and agent-side config access that could be reused for package compromise, persistence, and downstream supply-chain abuse.

1. Entry occurred when a malicious VS Code extension and earlier package-chain payloads reached developer machines through trusted tooling and dependency paths.
2. Credential access followed as the payload collected npm, AWS, GitHub, SSH, and agent configuration secrets from disk and startup files.
3. Impact was achieved when stolen tokens and keys enabled further package compromise, persistent reinfection, and wider supply-chain spread.

Breaches seen in the wild

• CoPhish OAuth Token Theft via Copilot Studio — CoPhish campaign exploits Microsoft Copilot Studio agents to steal OAuth tokens via AI-assisted phishing.
• GitHub Dependabot Breach — GitHub Dependabot tokens stolen and abused to push malicious commits to repositories.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential theft in agent traces is really a governance problem, not just a detection problem. The article shows that the useful signal is not the model’s output but the tool paths the harness records. That means identity teams need to think about where NHI secrets live on developer endpoints and which systems are allowed to read them. If an agent can reach a credential file, trace data can expose it, but only after the trust boundary has already been crossed. The practitioner conclusion is that trace visibility must be designed as part of NHI governance, not added as an afterthought.

Harness trust is a broken assumption in AI coding environments. The assumption that a harness will only run intended tools was designed for trusted local execution and benign startup hooks. That assumption fails when malicious extensions or hooked config files can trigger the harness to read and reuse secrets on the next session. The implication is that runtime agent behaviour must be governed as a separate identity surface, because the harness can become the mechanism through which credential abuse is laundered into ordinary tool use.

Off-tree read detection is a named concept worth adopting across agent programmes. It captures the specific failure mode in this article: an agent reading outside its workspace into home-directory or system-level credential locations. That is more precise than generic anomaly detection because it maps to an identity boundary violation, not just unusual behaviour. Practitioners should use the concept to align observability, endpoint telemetry, and NHI policy around one measurable event class.

Supply-chain abuse of developer credentials collapses the distinction between machine identity and developer identity. The article shows CI OIDC tokens, AWS keys, GitHub tokens, and SSH keys being harvested through the same tooling ecosystem that developers use every day. That creates a blended exposure model where one compromised toolchain can feed multiple identity domains. The conclusion is that IAM, PAM, and NHI governance have to be reviewed together when agents and developer tooling share the same execution plane.

Trace retention becomes an identity control when agent compromise is time-bounded. If malicious activity is brief, as it was in the 18-minute extension case, the only way to reconstruct what happened is to have session-level traces preserved long enough to query them after disclosure. This is not just observability hygiene. It is evidence preservation for identity abuse inside autonomous tool workflows, and that should be treated as a control objective in its own right.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• Only 44% of developers are reported to follow security best practices for secrets management, which helps explain why endpoint and harness telemetry need stronger governance.
• That same research reports that organisations maintain an average of 6 distinct secrets manager instances, so the next step is to align trace monitoring with cross-vault control rather than isolated tooling.

What this signals

Off-tree read detection: AI agent programmes should now treat file-path telemetry as a first-class identity signal, because that is where credential theft becomes visible. If the agent can see local secrets, the security model has already shifted from model safety to runtime access control. This is why the identity boundary needs to move closer to the harness and the workstation, not only the vault.

The broader signal is that developer tooling is becoming part of the NHI estate. Trace retention, dependency governance, and endpoint controls now sit on the same path as secrets rotation and privilege review, especially when agents can read local config and credential stores. Teams that do not connect those layers will struggle to explain where a stolen token came from or how long it was exposed.

For practitioners

• Instrument tool-call file paths Record every file path touched by agent tools and classify whether it sits inside or outside the workspace. Off-tree reads should be treated as credential-theft indicators, not generic noise.
• Version-control harness configuration Commit .claude/settings.json, .vscode/tasks.json, and similar startup hooks so changes appear in normal review flows. This makes hidden persistence much harder to maintain.
• Pin and review agent dependencies Lock package versions and inspect diffs in every pull request so a malicious transitive update cannot slip into the toolchain unnoticed.
• Deploy honeytokens in credential stores Place fake AWS, npm, or API tokens in locations that should never be used legitimately and alert on any attempt to access or validate them.
• Retain agent traces for incident reconstruction Keep trace data long enough to query which tool calls ran during a disclosure window, then correlate those calls with endpoint and identity logs.

Key takeaways

• AI coding agents can turn local developer secrets into a live identity exposure path when harnesses, extensions, or configs are compromised.
• Trace data is valuable security telemetry because off-tree reads reveal credential-harvesting behaviour that ordinary performance monitoring will miss.
• The right response is layered control across traces, dependencies, endpoint visibility, and credential stores, not reliance on the harness alone.

Key terms

• Agent Harness: The agent harness is the runtime layer that wraps a model and turns it into an acting system. It usually includes the loop, tools, context handling, permissions, hooks, and logs. In security terms, it is often the real place where privilege sits and where identity evidence must be governed.
• Off-Tree Read: An off-tree read is any file access outside the agent’s workspace or approved project boundary, such as home-directory credentials or system configuration files. It is a useful identity-security signal because credential theft often starts by reaching beyond the normal working tree.
• Harness trust boundary: The set of permissions, execution limits, and review rules that define what an AI-assisted security tool is allowed to see and do. In practice, it determines whether the tool is a passive analyzer or a privileged actor in the development workflow.
• Trace Telemetry: Trace telemetry is structured runtime data that records agent tool calls, inputs, outputs, and timing. For identity security, it becomes evidence of who or what touched a secret, which paths were accessed, and whether behaviour crossed an approved boundary.

What's in the full article

Arize's full article covers the operational detail this post intentionally leaves for the source:

• The exact OpenInference span handling used to classify file reads and attach session-level attributes.
• The Arize AX monitor configuration that sums off-tree reads across root spans and fires on threshold breach.
• The sample handler and Gist-based implementation details for reproducing the detection in your own environment.
• The synthetic demo sequence that shows how compromised sessions appear in trace data and why the alert fires.

👉 Arize's full post shows the handler logic, monitor setup, and synthetic demo in detail.

Deepen your knowledge

NHI governance, machine identity security, workload identity, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or NHI governance programme, it is worth exploring.