BioShocking: AI Browser Agent Reading SSH Private Key Files

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects file operations (creation, modification, deletion, renaming) involving common SSH key files (id_rsa, id_ed25519) or files located within .ssh directories, initiated by processes typically associated with AI/LLM tools (chatgpt, perplexity, etc.) or generic process names. This may indicate an attempt to exfiltrate or manipulate authentication credentials by unauthorized applications.