[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

hunt idea based on SANS ISC web-honeypot observation (Stormcast, Nov 9) and Apiiro research; not a vendor-published detection

Hunt: web requests for /.claude/ paths, now being probed after the settings.local.json secrets research

  • Web and CDN logs: requests for /.claude/, /.claude/settings.local.json or /.claude/settings.json, especially from scanners that also ask for /.env or /.git/config. A 200 response is an incident: rotate whatever that file contained.
  • Prevention: deny dot-directories at the web server, and keep .claude/settings.local.json out of git and out of deploy artifacts.
  • See our Apiiro item for the underlying issue.

Sources: SANS Stormcast, Nov 9 · Apiiro: coding agents leaking secrets on GitHub