Credential theft in AI agent harness traces demands new monitoring

At a glance

What this is: Arize details how credential theft in AI agent harness traces can be detected by flagging off-tree file reads from agent tool calls.

Why it matters: This matters because teams running AI coding agents need visibility into harness-level abuse, but telemetry only helps if it is treated as one layer in a broader supply-chain and host control model.

By the numbers:

• In May 2026, a malicious version of a popular VS Code extension ran on roughly 6,000 developer machines.
• The earlier attack reached more than 400 malicious versions across 172 packages.

Context

AI agent harness traces are the telemetry created when an agent calls tools, reads files, and acts during a session. In this article, Arize argues that those traces can reveal credential theft, but only when teams know what abnormal tool use looks like.

The governance gap is that many teams instrument agents for quality and performance without treating the harness as a security-relevant execution layer. That leaves package compromise, malicious hooks, and off-tree file access visible only after the damage has already spread.

For identity practitioners, the issue sits at the intersection of NHI, software supply chain risk, and workload access paths. The article shows that agent monitoring can catch abuse, but it does not replace host telemetry, dependency control, or secret hygiene.

Key questions

Q: What breaks when an AI agent harness runs tool calls and execution in the same trust domain?

A: Policy becomes advisory, identity checks lose their enforcement point, and audit logs can no longer distinguish intended tool use from unsafe execution. In practice, that means one compromise or misuse path can affect the entire agent environment. Enterprise harnesses need clear seams between the agent loop, tools, and execution to remain governable.

Q: Why do off-tree file reads matter for credential theft in AI coding agents?

A: Off-tree file reads matter because credential theft usually begins by stepping outside the workspace and into locations where tokens, keys, and config files live. When an agent touches ~/.aws, ~/.ssh, or similar paths during an ordinary coding task, that is a strong indicator that the session has crossed from code assistance into identity exposure.

Q: How do security teams know if coding agent monitoring is actually working?

A: Monitoring is working when it can correlate session behavior, file access, tool use, and network attempts into a single investigative trail. Useful signals include taint tracking after sensitive file access, anomaly detection after external content ingestion, and alerts on writes to restricted paths. If those patterns are visible, the program can distinguish intended work from manipulated behavior.

Q: How should teams govern AI tooling after a supply chain compromise?

A: Teams should treat AI tooling as a governed access layer, not just an application dependency. That means isolating credentials by tool and environment, enforcing explicit approval for publishing actions, and making revocation paths immediate when a scanner, gateway, or package pipeline shows signs of compromise or unexpected privilege use.

Technical breakdown

How off-tree reads expose harness abuse

An off-tree read is any file access outside the workspace the agent is supposed to operate in. In a normal coding session, tool calls should stay inside the project tree. When a malicious extension or hooked config file tells the harness to reach into ~/.aws/credentials, ~/.ssh/id_rsa, or other home-directory paths, the trace becomes a record of suspicious scope expansion. The monitor described here counts those reads at the session level and treats any off-tree access as a security signal. The point is not that every external path is malicious, but that credential theft often starts by stepping outside the expected workspace boundary.

Practical implication: Treat workspace boundary violations as a monitorable security event, not just an observability anomaly.

Why the harness is not a security boundary

The harness loads tools, dispatches model output, and executes lifecycle hooks such as editor-open events. That makes it part of the execution path, not a trust boundary. If a malicious dependency, compromised extension, or hooked config file is already on disk, the next harness action can execute attacker-controlled logic without any model prompt looking unusual. This is why the article frames the problem as a supply-chain issue as much as a runtime issue. The harness can surface the abuse, but it also becomes one of the places where abuse is triggered and persisted.

Practical implication: Assume harness code can be abused and verify it with the same discipline used for build and deployment dependencies.

How trace classification turns tool calls into detection

The article’s detection pattern is straightforward: instrument each tool call as a span, record the path touched, classify whether that path sits inside or outside the workspace, and aggregate the result on the root agent session span. The monitor then fires when the off-tree count is above zero. This is a useful example of security telemetry built from existing agent observability rather than a separate sensor stack. It works because the agent already emits structured traces, and the classification logic can be applied after the fact to a narrow, high-signal indicator.

Practical implication: Build security detections from existing agent traces where possible, then validate them against known abuse paths.

Threat narrative

Attacker objective: Steal developer credentials and persistence hooks from AI coding environments so the compromise can spread through trusted tooling.

1. Entry occurred through a compromised VS Code extension that ran on developer machines and also through a separate package-chain compromise that seeded malicious versions into registries.
2. Credential harvesting followed as the payload searched for npm, AWS, GitHub, SSH, vault, and Claude Code configuration files stored on disk.
3. Persistence emerged when the earlier attack wrote hooks into .claude/settings.json and .vscode/tasks.json, causing the payload to re-run on subsequent editor activity.
4. Impact was the theft of developer credentials and the continued exposure of agent and workspace access paths across the toolchain.

Breaches seen in the wild

• GitHub internal repositories breach 2026: A stolen GitHub CLI token let attackers publish a poisoned Nx Console extension that harvested secrets and exfiltrated 3,800 GitHub repos.
• Amazon Q Developer extension compromise 2025: An over-scoped CI token let an attacker ship a prompt telling Amazon Q's AI coding agent to wipe files and AWS resources (CVE-2025-8217).

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Harness telemetry is becoming a security control, not just an observability feature. AI coding agents already emit the data needed to spot abnormal tool use, and the article shows that file-path inspection can surface credential theft patterns quickly. That does not make traces a boundary, but it does make them a valuable detection layer when the agent stack is instrumented correctly. Practitioners should treat trace design as part of agent governance, not an afterthought.

Agent harnesses collapse the assumption that runtime tooling is benign if the model behaves. The trust boundary is not the model output alone; it also includes the code that loads tools, fires hooks, and decides what gets executed. Once a malicious extension or config file reaches disk, the harness can execute attacker-controlled actions without any visible prompt anomaly. The implication is that harness-level governance must be designed as supply-chain governance, because runtime abuse often begins before the agent even reasons about a task.

Credential theft in AI coding stacks is an identity problem, not only a malware problem. The article’s targets were not abstract workloads but real developer credentials, tokens, and keys that grant access across cloud and code systems. That makes AI agent monitoring relevant to NHI governance because the stolen artefacts are identity material, not merely files. The security question is no longer whether the agent is useful; it is whether the identity surfaces around it are measurable, revocable, and scoped tightly enough to absorb compromise.

Off-tree read monitoring creates an identity blast-radius lens for agent sessions. The named concept here is the identity blast radius of a session: how far a tool-using agent can reach beyond its intended workspace. That concept matters because a single read into home-directory credentials can turn an ordinary coding session into a multi-system compromise path. Practitioners should use this lens to decide where agent observability, secret storage, and local filesystem controls need to converge.

Supply-chain compromise of agent tooling should be handled as a lifecycle failure, not a one-off incident. The attacks described here moved through package registries, editor extensions, runtime hooks, and stored credentials in a chain of trust that spans build, install, and execution. That is why narrow monitoring alone is incomplete. The broader governance conclusion is that AI agent tooling now needs lifecycle controls across dependency provenance, local configuration, and credential exposure windows.

From our research library:

• 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: AI Coding Agents Security Guide

What this signals

Off-tree reads define the new identity blast radius for agent sessions: the useful security question is not whether an AI coding agent can complete a task, but how far beyond the workspace its tool calls are allowed to reach. When that reach extends into home-directory secrets, the session itself becomes the compromise surface, and telemetry has to be evaluated as a security control rather than a debugging aid.

Agent harness monitoring is strongest when it is narrow and specific. A session-level count of off-tree reads is easy to explain, easy to alert on, and easy to correlate with suspicious dependency activity, but it only works if teams already know what paths are legitimate and retain traces long enough to investigate after disclosure.

The broader programme implication is that AI coding tools now sit inside the same trust chain as packages, extensions, and local secrets. That means identity and security teams need to align trace-based detection with dependency governance and credential containment, or the next compromise will be visible only after the credential theft has already been abused.

For practitioners

• Instrument agent sessions for off-tree reads Record the file paths each tool call touches and aggregate counts on the root session span so you can alert on reads outside the workspace.
• Pin and review agent dependencies Lock editor extensions, package versions, and agent libraries so a malicious update cannot enter through a transitive dependency change.
• Version control harness configuration files Commit .claude/settings.json and .vscode/tasks.json so persistence hooks show up as diffs instead of silently living on disk.
• Add honeytokens to credential locations Place fake keys in paths such as ~/.aws/credentials or ~/.claude/anthropic_api_key and alert on any attempt to use them.
• Retain traces across disclosure windows Keep agent traces long enough to query tool calls after a compromise is disclosed, because the initial evidence may only be visible in historical spans.

Key takeaways

• AI coding agents can leak credentials through their own harness traces, especially when a malicious extension or hooked config file drives off-tree access.
• The article’s detection pattern is simple but powerful: count reads outside the workspace and alert on the first suspicious session.
• Trace monitoring helps, but it only reduces risk when paired with dependency pinning, config review, and secret containment.

Key terms

• Agent Harness: The agent harness is the runtime layer that wraps a model and turns it into an acting system. It usually includes the loop, tools, context handling, permissions, hooks, and logs. In security terms, it is often the real place where privilege sits and where identity evidence must be governed.
• Off-Tree Read: An off-tree read is any file access outside the agent’s workspace or approved project boundary, such as home-directory credentials or system configuration files. It is a useful identity-security signal because credential theft often starts by reaching beyond the normal working tree.
• Trace-Based Detection: Trace-based detection uses structured agent telemetry, such as spans and tool-call metadata, to spot suspicious behavior after it happens. For AI coding agents, it can reveal scope drift, credential harvesting, and abnormal file access when the underlying trace records include the file paths touched.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.