Notifications
Clear all
Topic starter
19/08/2026 4:05 pm
TL;DR: Compromised AI coding tools can steal cloud, GitHub, and SSH credentials from developer machines, and off-tree file reads in agent traces provide a practical detection signal for harness-level abuse, according to Arize. The deeper issue is that agent harnesses are not a security boundary, so tracing must be paired with supply-chain and host controls.
NHIMG editorial — based on content published by Arize: How to detect credential theft in AI agent harness traces
By the numbers:
- In May 2026, a malicious VS Code extension ran on roughly 6,000 developer machines in 18 minutes before it was caught.
- The earlier attack reached more than 400 malicious versions across 172 packages by abusing stolen OIDC tokens from CI pipelines.
Questions worth separating out
Q: What breaks when AI agents can read files outside their workspace?
A: Off-tree reads break the assumption that an agent only touches project data.
Q: Why do AI assistants create more credential risk than traditional developer tools?
A: They often aggregate access to many external services in one workflow, then persist those credentials in predictable local files or sync them into shared environments.
Q: What do security teams get wrong about logging agent activity?
A: Teams often assume that detailed logs equal control.
Practitioner guidance
- Instrument tool-call file paths Record every file path touched by agent tools and classify whether it sits inside or outside the workspace.
- Version-control harness configuration Commit .claude/settings.json, .vscode/tasks.json, and similar startup hooks so changes appear in normal review flows.
- Pin and review agent dependencies Lock package versions and inspect diffs in every pull request so a malicious transitive update cannot slip into the toolchain unnoticed.
What's in the full article
Arize's full article covers the operational detail this post intentionally leaves for the source:
- The exact OpenInference span handling used to classify file reads and attach session-level attributes.
- The Arize AX monitor configuration that sums off-tree reads across root spans and fires on threshold breach.
- The sample handler and Gist-based implementation details for reproducing the detection in your own environment.
- The synthetic demo sequence that shows how compromised sessions appear in trace data and why the alert fires.
👉 Read Arize's analysis of how agent traces can detect credential theft →
AI agent harness traces: can your telemetry catch credential theft?
Explore further
19/08/2026 4:39 pm
Credential theft in agent traces is really a governance problem, not just a detection problem. The article shows that the useful signal is not the model’s output but the tool paths the harness records. That means identity teams need to think about where NHI secrets live on developer endpoints and which systems are allowed to read them. If an agent can reach a credential file, trace data can expose it, but only after the trust boundary has already been crossed. The practitioner conclusion is that trace visibility must be designed as part of NHI governance, not added as an afterthought.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, which helps explain why endpoint and harness telemetry need stronger governance.
A question worth separating out:
Q: How should teams investigate suspected credential theft in an agent harness?
A: Start with the agent session, identify off-tree reads, and correlate those file paths with endpoint, package, and identity logs. Then check whether malicious code entered through a dependency, an editor extension, or a persistent config hook so you can trace the abuse path end to end.
👉 Read our full editorial: Credential theft in AI agent harness traces demands new monitoring
