Skip to content
Threat Feed
Subscribe
high advisory

Unauthorized GenAI Tool Access to Sensitive Local System Files

Attackers are increasingly leveraging GenAI agent processes to perform unauthorized discovery, harvesting of sensitive credentials, and establishment of persistence via shell configuration modifications.

Modern GenAI tools, including local agents and developer-focused LLM interfaces, are being abused by attackers to perform automated credential harvesting and system manipulation. These tools possess broad file-system read capabilities, which can be weaponized to target cloud credentials, SSH keys, browser password databases, and shell initialization scripts. The threat is particularly significant for developers or administrators who have high-privilege credentials cached on their workstations. Attackers may inject malicious instructions into GenAI configuration files or leverage Model Context Protocol (MCP) servers to extend the AI agent's file system interaction capabilities, allowing for systematic exfiltration or persistence. Defenders must monitor for unusual process-to-file access patterns originating from known GenAI binary names across Windows, Linux, and macOS environments.

Impact

The abuse of GenAI tools facilitates rapid, automated credential theft and the compromise of local persistence mechanisms. If successful, attackers obtain stored credentials for cloud environments, source code repositories, and secure shell (SSH) sessions, potentially leading to downstream lateral movement, unauthorized access to corporate resources, and persistent system backdoors. The impact is elevated when GenAI tools are integrated into developer workstations that hold sensitive production keys or API tokens.

Recommendation

  • Implement the provided detection logic to monitor file access activity originating from common GenAI tool binaries.
  • Review and restrict GenAI tool access to sensitive directories such as .aws, .ssh, and browser profile locations.
  • Audit the use of AI agents in developer workflows, specifically monitoring for the usage of autonomous file-system-aware plugins or MCP servers.
  • Rotate API keys, SSH keys, and credentials found in environment paths frequently accessed by AI development tools.
  • Establish a policy defining authorized GenAI tools and their allowed scopes of operation on sensitive endpoints.

Immediate actions

Deploy process-to-file monitoring for GenAI binaries

Detection Engineering 48h

Threat Hunt

Search for unexpected file access to .ssh or .aws directories by developer workstation processes

T1552.001 high medium confidence hunt now

Data: Endpoint file access logs

Enrichment needed

  • GenAI binary inventory (IT Operations) Need to verify if tools in the rule are authorized in the corporate environment

Mitigations

Review and restrict AI agent permissions

short_term IT Operations

T1552.001

Detection coverage 1

Detect GenAI Process Accessing Sensitive Files

high

Detects when known GenAI tools perform open, creation, or modification operations on sensitive credential stores or shell configuration files.

sigma tactics: credential_access techniques: T1552.001 sources: file_event, windows

Detection queries are available on the platform. Get full rules →