LLM-Mediated Credential Harvesting

Adversary Behavior: An adversary uses prompt injection — via configuration files, context poisoning, or tool return values — to instruct the LLM assistant to locate and extract sensitive credentials stored in the project workspace.

AI/IDE Mechanism: The LLM assistant has read access to project files and potentially environment variables as part of its standard operation. This access scope enables the model to search for patterns matching API keys, database connection strings, authentication tokens, private keys, and other secrets when directed to do so by injected instructions.

Execution Path: The adversary injects credential search instructions through any available injection vector. The LLM is directed to scan workspace files and environment variables for credential patterns. Extracted credentials are then exfiltrated through the LLM's available output channels: included in generated code, embedded in tool call arguments (e.g., web requests, file writes to shared locations), or returned as part of the LLM's visible response.

Security Impact: Credential compromise provides the adversary with direct access to external services, databases, APIs, and infrastructure resources associated with the harvested credentials, enabling further lateral movement and data access beyond the development environment.