Once an attacker runs code on a machine that talks to AI services, the tokens and keys those services rely on are sitting in process memory and local stores, ready to be read. MITRE ATLAS tracks this as AML.T0090 OS Credential Dumping, in the Credential Access tactic (AML.TA0013). ATLAS mirrors ATT&CK T1003 and adds the AI angle: the dumped credentials can be used to move laterally to AI agents, LLMs and inference APIs, and to reach the tools and data sources of the AI DevOps lifecycle. Classic LSASS, SAM and /etc/shadow dumping is covered in the T1003 OS Credential Dumping guide; this page covers what changes on AI desktop clients, agent hosts, notebook servers and inference nodes. It is for endpoint, identity and AI platform teams.
Key takeaways
- The prize is often an AI session, not a password hash. In the AIKatz research, recorded by ATLAS as AML.CS0036, a session token read from an AI desktop app's memory let the attacker act as the user against the LLM backend.
- Same-user code execution can be enough. The researchers describe the attack running as the same user and logon session, with no elevation, so LSASS protections do not stop it.
- ATLAS maps one mitigation. Release 2026.10 maps AML.M0011 Restrict Library Loading to AML.T0090, aimed at dumping paths that inject or load code into processes holding authentication material.
- Revoke sessions, not just passwords. A dumped AI token stays valid after a password reset unless the session is revoked at the provider.
- Short-lived, scoped credentials limit the damage. Workload identity and per-app tokens mean a dump from one host yields access to one thing, briefly.
What ATLAS records
ATLAS created AML.T0090 in October 2025, last modified it in May 2026 and rates its maturity as demonstrated (shown in research, not yet recorded in an incident). It describes extracting credentials from OS caches, application memory or other sources on a compromised system, in the form of hashes, clear text, application tokens or other authentication keys. Two related ATLAS entries are separate: AML.T0106 Exploitation for Credential Access covers exploiting a software flaw to get credentials (see AML.T0106 Exploitation for Credential Access), and AML.T0055 Unsecured Credentials covers secrets left in files and configuration. AML.T0090 is reading credentials out of the running system.
Where credentials sit on AI hosts
| Host type | Credential material in memory or OS stores | What a dump unlocks |
|---|---|---|
| Staff laptop with AI desktop apps | Bearer tokens or session cookies inside the app's Chromium-based processes; browser cookie stores; OS credential cache | The user's AI chats, files and memory; for assistants tied to the office suite, possibly document store tokens |
| Agent host or coding agent workstation | Model API keys, MCP server and tool tokens, cloud CLI sessions, Git credentials held by the agent process and its children | Every tool and data source the agent can reach |
| Notebook and training servers | Model hub tokens, cloud keys and data store credentials loaded into kernel processes and their environment | Training data, model registries and weights, experiment tracking |
| Inference and serving nodes | Provider API keys, service account tokens, database credentials held by the serving process | Model endpoints, billing, connected retrieval stores |
| Windows hosts in the AI estate | LSASS memory (NTLM hashes, Kerberos tickets), SAM | Domain identities of AI engineers and service accounts, as in classic T1003 |
The ATT&CK sub-techniques that matter most here are T1003.001 LSASS Memory on Windows and T1003.007 Proc Filesystem on Linux, where process memory and environment are reached through /proc.
The AIKatz case
ATLAS records AIKatz (AML.CS0036), an exercise by Lumia researchers, as a longer chain that includes these four steps:
- Discovery (AML.T0089): the attacker enumerated running processes and found those belonging to LLM desktop applications.
- Credential dumping (AML.T0090): the attacker read the application's process memory, through /proc on Linux or a process handle on Windows, and found the victim's authentication token.
- Token use (AML.T0091.000): the token authenticated the attacker to the LLM backend. See AML.T0091 Use Alternate Authentication Material.
- History manipulation (AML.T0092): the attacker could read, inject and alter conversations. See MITRE ATLAS AML.T0092 Manipulate User LLM Chat History.
The research covered the ChatGPT and Claude desktop apps (Electron) and Microsoft 365 Copilot (WebView2). Lumia reports that ChatGPT and Copilot hold a bearer JWT and Claude a session key cookie, and that the attack needs code running as the same user, not administrator rights. ATLAS records that the vendors closed the reports as informational or as not crossing a security boundary, because the attack is local to one user session. The practical lesson is that endpoint compromise becomes AI account takeover, and that the controls have to sit on the endpoint and in session management.
Detection
| Data source | Signal | Notes |
|---|---|---|
| Sysmon Event ID 10 (ProcessAccess) | Any process opening AI desktop app processes or agent processes with memory read access, from an image that is not the app itself or a known security tool | Microsoft notes this event is noisy without filters; include AI app images as targets alongside lsass.exe |
| Sysmon Event ID 8 (CreateRemoteThread) | Remote threads created in AI app or LSASS processes | Injection route for dumping |
| EDR process access telemetry | Cross-process memory reads of AI clients, credential manager or browser processes | Lumia recommends EDR alerts on memory access to AI app processes |
| Linux audit (auditd) or eBPF sensors | ptrace attach, process_vm_readv, or reads of /proc/<pid>/mem and /proc/<pid>/environ for agent, notebook and serving processes | Maps to T1003.007 |
| Windows CodeIntegrity Operational log | Events 3033 and 3063 (enforced) or 3065 and 3066 (audit) when unsigned code tries to load into protected LSASS | Confirms LSA protection is doing its job |
| AI provider audit and usage logs | The same session used from a second device or network soon after an endpoint alert; unexpected chat deletions, injected messages or memory changes | The downstream proof that a dumped token was used |
Measuring it
- Telemetry coverage: share of AI-using endpoints and agent hosts sending process access events to the SIEM.
- Protected LSASS: share of Windows hosts showing WinInit event 12 (LSASS started as a protected process).
- ptrace restriction: share of Linux agent, notebook and serving hosts with Yama ptrace_scope set to 1 or higher.
- Token lifetime: median lifetime of model API and model hub tokens on these hosts, trending down.
- Revocation time: time from an endpoint credential theft alert to revocation of the user's AI sessions and tokens.
Mitigations
| Control | What it does on AI hosts | Source |
|---|---|---|
| AML.M0011 Restrict Library Loading (ATT&CK M1044) | Blocks dumping paths that load code into processes holding tokens; restrict write access to PATH folders searched by AI apps | ATLAS 2026.10 mapping; Lumia reported a DLL search path issue in one AI client |
| Process access restriction | Tighter access control on AI app worker processes so other processes cannot read their memory; test compatibility first | Lumia recommendation |
| LSA protection (RunAsPPL) | Runs LSASS as a protected process; set HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL to 1 (UEFI lock) or 2 | Microsoft Learn |
| Credential Guard | Isolates NTLM hashes, Kerberos TGTs and stored domain credentials with virtualisation-based security; it does not protect application tokens such as AI sessions | Microsoft Learn |
| Yama ptrace_scope | 1 limits attach to descendants, 2 to CAP_SYS_PTRACE holders, 3 disables ptrace and cannot be changed afterwards | Linux kernel documentation |
| Least privilege and application control | Remove local admin, block untrusted code on hosts that run agents or hold AI tokens | Lumia; NIST AC-6, CM-7 |
| Short-lived, scoped credentials | Workload identity federation, per-app tokens and short sessions so a dump has limited reach and life | NIST IA-5 |
LSA protection and Credential Guard address classic Windows dumping only. Neither protects tokens held by an AI app running as the user, so the session-side controls in the next section carry more weight for AI clients.
Session-side controls
- Revoke at the provider: when an endpoint is compromised, sign the user out of every AI service and revoke API tokens; a local password reset does not invalidate a stolen AI session.
- Bind sessions to devices where offered: device-bound or sender-constrained tokens reduce the value of a token read from memory.
- Collect AI provider logs: without them, use of a dumped token looks like normal use.
- Limit what is in chat: data governance for AI chats reduces what a stolen session exposes.
- Separate agent identities: give each agent its own workload identity rather than a developer's personal tokens. See the AI Infrastructure Workload Identity Guide.
Decision guidance
| Situation | Priority (our recommendation) |
|---|---|
| Staff using AI desktop apps on Windows | EDR alerts on memory access to AI app processes, no local admin, AI session revocation in the incident runbook |
| Linux hosts running agents, notebooks or model serving | ptrace_scope 1 or higher (2 for servers without debugging needs), audit of /proc memory reads, workload identity instead of static keys |
| Windows domain hosts used by AI engineers | LSA protection and Credential Guard enforced after audit mode |
| Small organisation | Remove local admin, keep EDR on every AI-using device, use per-app API keys with spend alerts |
How to implement and test
- Inventory: list hosts that run AI clients, agents, notebooks or serving, and the tokens each holds.
- Audit first: enable LSA protection audit mode (AuditLevel 8 under the LSASS.exe Image File Execution Options key) and review CodeIntegrity events before enforcing. Set ptrace_scope on a pilot ring and check debugging and profiling tools still work.
- Add detections: extend Sysmon or EDR process access rules to AI app and agent process images, with filters for known good accessors.
- Test in a lab: with an authorised test account, have a benign test process open the AI client's process for memory read and confirm the alert fires. Do not use real user tokens.
- Drill revocation: simulate an endpoint compromise and time how long the user's AI sessions and API tokens stay valid.
- Roll back safely: LSA protection set with UEFI lock needs Microsoft's opt-out tool to remove, so pilot with value 2 first; ptrace_scope 3 cannot be lowered without a reboot.
Where identity fits
Credential dumping turns one endpoint into many identities. On AI hosts the identities that matter most are non-human: model API keys, agent tool tokens, model hub tokens and cloud workload credentials. The defence is to make each of them scoped to one purpose, short-lived and revocable at the provider, and to give agents their own identities instead of borrowing a developer's. See the Agent Identity and Access Guide and MITRE ATLAS AML.T0083 Credentials from AI Agent Configuration.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATLAS | AML.T0090 (AML.TA0013 Credential Access); chain AML.T0089, AML.T0091.000, AML.T0092 | Technique and the AIKatz chain |
| MITRE ATLAS case study and mitigation | AML.CS0036; AML.M0011 | Recorded use and mapped mitigation in release 2026.10 |
| MITRE ATT&CK | T1003, T1003.001, T1003.007; mitigations M1043 Credential Access Protection, M1025 Privileged Process Integrity; M1044 Restrict Library Loading (ATT&CK counterpart of AML.M0011) | Enterprise mirror |
| NIST SP 800-53 Rev. 5 | AC-6, CM-7, IA-5, SC-39, SI-4, AU-12 | Least privilege, least functionality, authenticators, process isolation, monitoring |
| NIST CSF 2.0 | PR.AA-05, PR.PS-01, DE.CM-09 | Least privilege, configuration, runtime monitoring |
Common failure patterns
- Watching LSASS only: process access rules that cover lsass.exe but not AI clients, agents or serving processes.
- Assuming Credential Guard covers AI tokens: it isolates domain secrets, not application session tokens.
- Developer tokens on agent hosts: agents running with an engineer's personal, broad, long-lived keys.
- Debugging left open: ptrace_scope 0 on production agent and serving hosts.
- Password reset as the whole response: leaving AI sessions and API tokens valid after an endpoint compromise.
- Writable PATH folders: shared, writable directories on the search path of AI clients, the issue Lumia reported.
Practitioner checklist
- Inventory hosts that run AI clients, agents, notebooks or serving, and the tokens each holds.
- Alert on memory access to AI app and agent processes, not only LSASS.
- Enforce LSA protection and Credential Guard on Windows hosts after audit mode.
- Set Yama ptrace_scope to 1 or higher on Linux AI hosts and audit /proc memory reads.
- Remove local admin and restrict writable PATH folders on AI-using endpoints.
- Replace static keys on agent and serving hosts with short-lived workload identity.
- Add AI session and token revocation to the endpoint compromise runbook.
- Send AI provider audit logs to the SIEM and correlate with endpoint alerts.
Standards and references
- MITRE ATLAS: OS Credential Dumping
- MITRE ATLAS: AIKatz: Attacking LLM Desktop Applications
- MITRE ATLAS: Restrict Library Loading
- MITRE ATT&CK: T1003 OS Credential Dumping
- Lumia Security: AIKatz research
- Microsoft Learn: Configure added LSA protection
- Microsoft Learn: Credential Guard overview
- Linux kernel documentation: Yama
Related NHI Mgmt Group resources: MITRE ATLAS Guide · Credential Dumping Guide · EDR Guide · AML.T0089 Enterprise Environment Discovery