Cursor Agent Decrypted Keychain Dump Filtered for Linear/MCP OAuth

Duo Tech@duotech

•updated Aug 10, 2026•0•0•5

Detects a decrypted Keychain dump (security dump-keychain -d) spawned from a Cursor/coding-agent process with output filtered for Linear, MCP, or OAuth-related strings, indicating targeted credential theft of MCP/Linear integration tokens.