Credential File Theft from Agent Environment - ATR-2026-00113 (ce8a59e5-a77d-5b9b-b053-83947f9a0e2b)
Detects tools or agent instructions that access well-known credential files from the host environment. Attackers target files like ~/.aws/credentials, SSH private keys, Docker configs, and Kubernetes configs to gain lateral movement capabilities. When credential file access is combined with a network call, this strongly indicates exfiltration rather than legitimate local usage.