CODING-AGENT CREDENTIALS · LOOT LIST v1
One scanner requested 102 filesystem paths from my n8n decoy
On 10 August 2026 one session hit the decoy with 102 GET paths in 10.8 seconds. No repeats. .claude, .codex, .qwen, .kimi-code, .grok, .hermes, opencode, then git, npm, docker, aws, ssh, shell, /proc. Three home roots plus the process working directory.
Cite: unauth.dev loot list v1, observed 2026-08-10, CC-BY 4.0. SHA-256: 0e21f8374e9e166f8ba2e7f0f630de44c26ccdfb901adb31db04ee54514fe7fe. CC-BY 4.0.
At the time the decoy answered 8 of 102 with a file. 94 got the login page. The next day I added more fake files and replayed the same 102 paths: 98 would get a file. 4 are directories, so no file. That is expected.
Same 102 paths, replayed locally against the updated decoy. Not a live hit on the public box. We do not publish the fake file bodies.
| Same paths, new source | 2 |
|---|---|
| Through | 2026-09-05 |
| Canary path requested | 0 |
| Fake cred used elsewhere | 1 |
| Canary on the live decoy | yes |
Same 102-path fingerprint from a new source (>=20 overlapping v1 paths in one session). Original /24 and self-tests excluded.
Sessions that requested the publication-canary path. Self-tests and the original /24 excluded.
Stolen planted credential used off-box (sinkhole). Counts a honeytoken in the bytes, or SNI git/registry.10nr.es. Bare 5432 connects are noise and are not counted. Self-tests excluded.
Live decoy answers the publication-canary path.
- One session, one source, one decoy. Do not treat this as the internet.
- We are not saying the requester was an AI agent. The interesting part is which files they asked for.
- Asking for files is not the same as breaking in.
- Palisade measured web agents following planted instructions. GreyNoise measured Ollama scanning. This is a list of paths one session asked an n8n decoy for.
- We set a trap on 11 August for fake credentials used somewhere else. Nobody has tripped it. This list does not claim they did.
- We have not seen this session again. Do not invent later hits.
This is not: Palisade Research (web agents following planted instructions / phishing); GreyNoise (Ollama and AI-infra scanning volume); canary files (generic tripwire files and URLs) .
| When | 2026-08-10T16:03:01Z → 2026-08-10T16:03:12Z (10.767s) |
|---|---|
| Decoy | fake n8n, looking like 2.34.1 |
| Source | 192.161.49.0/24 |
| User-Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0 |
| Paths | 102 observed + 1 publication canary |
| Distinct files | 38 files × four home roots (not every file on every root) |
| Coding-agent paths | 44 of 102 |
Spoofed desktop Firefox. We are not saying this was an AI agent. Traffic like this cannot tell an agent from a script.
One source. We publish the /24, not the raw IP.
Claude Code (10)
| # | Root | File | At capture | Now |
|---|---|---|---|---|
| 8 | /root | .claude/.credentials.json | login page | answered |
| 26 | /root | .claude.json | login page | answered |
| 27 | /root | .claude/settings.json | login page | answered |
| 45 | /home/n8n | .claude/settings.json | login page | answered |
| 63 | /proc/self/cwd | .claude.json | login page | answered |
| 74 | /home/n8n | .claude.json | login page | answered |
| 80 | /home/node | .claude/settings.json | login page | answered |
| 87 | /home/n8n | .claude/.credentials.json | login page | answered |
| 92 | /proc/self/cwd | .claude/.credentials.json | login page | answered |
| 100 | /home/node | .claude.json | login page | answered |
OpenAI Codex (2)
| # | Root | File | At capture | Now |
|---|---|---|---|---|
| 9 | /root | .codex/auth.json | login page | answered |
| 44 | /home/node | .codex/auth.json | login page | answered |
Qwen (11)
| # | Root | File | At capture | Now |
|---|---|---|---|---|
| 17 | /root | .qwen/oauth_creds.json | login page | answered |
| 21 | /home/node | .qwen/settings.json | login page | answered |
| 35 | /home/node | .qwen/.env | answered | answered |
| 36 | /home/n8n | .qwen/oauth_creds.json | login page | answered |
| 41 | /root | .qwen/settings.json | login page | answered |
| 52 | /proc/self/cwd | .qwen/.env | answered | answered |
| 57 | /root | .qwen/.env | answered | answered |
| 69 | /home/node | .qwen/oauth_creds.json | login page | answered |
| 71 | /home/n8n | .qwen/.env | answered | answered |
| 82 | /proc/self/cwd | .qwen/oauth_creds.json | login page | answered |
| 84 | /proc/self/cwd | .qwen/settings.json | login page | answered |
Kimi (8)
| # | Root | File | At capture | Now |
|---|---|---|---|---|
| 28 | /root | .kimi-code/credentials/kimi-code.json | login page | answered |
| 53 | /home/n8n | .kimi-code/config.toml | login page | answered |
| 56 | /home/node | .kimi-code/credentials/kimi-code.json | login page | answered |
| 64 | /proc/self/cwd | .kimi-code/credentials/kimi-code.json | login page | answered |
| 66 | /home/node | .kimi-code/config.toml | login page | answered |
| 86 | /home/n8n | .kimi-code/credentials/kimi-code.json | login page | answered |
| 89 | /proc/self/cwd | .kimi-code/config.toml | login page | answered |
| 98 | /root | .kimi-code/config.toml | login page | answered |
Grok (2)
| # | Root | File | At capture | Now |
|---|---|---|---|---|
| 37 | /proc/self/cwd | .grok/auth.json | login page | answered |
| 97 | /root | .grok/auth.json | login page | answered |
Hermes (3)
| # | Root | File | At capture | Now |
|---|---|---|---|---|
| 2 | /proc/self/cwd | .hermes/auth.json | login page | answered |
| 40 | /home/node | .hermes/auth.json | login page | answered |
| 43 | /root | .hermes/auth.json | login page | answered |
OpenCode (8)
| # | Root | File | At capture | Now |
|---|---|---|---|---|
| 16 | /home/node | .config/opencode/opencode.json | login page | answered |
| 23 | /proc/self/cwd | .config/opencode/opencode.json | login page | answered |
| 39 | /root | .config/opencode/opencode.json | login page | answered |
| 65 | /proc/self/cwd | .local/share/opencode/auth.json | login page | answered |
| 68 | /home/node | .local/share/opencode/auth.json | login page | answered |
| 79 | /home/n8n | .local/share/opencode/auth.json | login page | answered |
| 88 | /home/n8n | .config/opencode/opencode.json | login page | answered |
| 95 | /root | .local/share/opencode/auth.json | login page | answered |
Git / GitHub (7)
| # | Root | File | At capture | Now |
|---|---|---|---|---|
| 7 | /root | .git-credentials | login page | answered |
| 14 | /root | .config/gh/hosts.yml | login page | answered |
| 31 | /root | .git/config | login page | answered |
| 33 | /home/node | .git-credentials | login page | answered |
| 34 | /home/node | .git/config | login page | answered |
| 61 | /home/n8n | .git/config | login page | answered |
| 75 | /home/n8n | .config/gh/hosts.yml | login page | answered |
npm (4)
| # | Root | File | At capture | Now |
|---|---|---|---|---|
| 4 | /root | .npmrc | login page | answered |
| 47 | /home/n8n | .npmrc | login page | answered |
| 90 | /proc/self/cwd | .npmrc | login page | answered |
| 102 | /home/node | .npmrc | login page | answered |
Docker (7)
| # | Root | File | At capture | Now |
|---|---|---|---|---|
| 10 | /home/node | docker-compose.yml | login page | answered |
| 29 | /root | docker-compose.yml | login page | answered |
| 32 | /home/node | .docker/config.json | login page | answered |
| 46 | /home/n8n | .docker/config.json | login page | answered |
| 54 | /proc/self/cwd | .docker/config.json | login page | answered |
| 55 | /home/n8n | docker-compose.yml | login page | answered |
| 58 | /root | .docker/config.json | login page | answered |
AWS (1)
| # | Root | File | At capture | Now |
|---|---|---|---|---|
| 51 | /proc/self/cwd | .aws/credentials | answered | answered |
SSH keys (4)
| # | Root | File | At capture | Now |
|---|---|---|---|---|
| 30 | /root | .ssh/id_ed25519 | login page | answered |
| 67 | /root | .ssh/id_rsa | login page | answered |
| 73 | /home/n8n | .ssh/id_rsa | login page | answered |
| 91 | /home/node | .ssh/id_rsa | login page | answered |
Shell history / rc (26)
| # | Root | File | At capture | Now |
|---|---|---|---|---|
| 3 | /root | .viminfo | login page | answered |
| 5 | /root | .bash_history | login page | answered |
| 6 | /root | .oh-my-zsh | login page | directory |
| 11 | /home/node | .profile | login page | answered |
| 12 | /home/n8n | .profile | login page | answered |
| 13 | /root | .zsh_history | login page | answered |
| 15 | /home/node | .viminfo | login page | answered |
| 18 | /proc/self/cwd | .zshrc | login page | answered |
| 19 | /proc/self/cwd | .bashrc | login page | answered |
| 20 | /home/node | .bash_history | login page | answered |
| 24 | /proc/self/cwd | .profile | login page | answered |
| 25 | /root | .bashrc | login page | answered |
| 38 | /root | .profile | login page | answered |
| 42 | /proc/self/cwd | .bash_history | login page | answered |
| 49 | /home/n8n | .oh-my-zsh | login page | directory |
| 50 | /proc/self/cwd | .zsh_history | login page | answered |
| 59 | /root | .zshrc | login page | answered |
| 62 | /proc/self/cwd | .viminfo | login page | answered |
| 70 | /home/n8n | .bashrc | login page | answered |
| 77 | /home/node | .zshrc | login page | answered |
| 78 | /home/n8n | .bash_history | login page | answered |
| 81 | /proc/self/cwd | .oh-my-zsh | login page | directory |
| 93 | /home/n8n | .zsh_history | login page | answered |
| 96 | /home/node | .bashrc | login page | answered |
| 99 | /home/node | .zsh_history | login page | answered |
| 101 | /home/n8n | .zshrc | login page | answered |
App config / source (3)
| # | Root | File | At capture | Now |
|---|---|---|---|---|
| 22 | /proc/self/cwd | app.py | login page | answered |
| 60 | /proc/self/cwd | .env | answered | answered |
| 72 | /proc/self/cwd | config.py | login page | answered |
procfs (4)
| # | Root | File | At capture | Now |
|---|---|---|---|---|
| 76 | /proc/self | cmdline | login page | answered |
| 83 | /proc/self | maps | login page | answered |
| 85 | /proc/self | cwd | login page | directory |
| 94 | /proc/self | environ | answered | answered |
Unix system files (2)
| # | Root | File | At capture | Now |
|---|---|---|---|---|
| 1 | /etc | passwd | answered | answered |
| 48 | /etc | shells | login page | answered |
The JSON/CSV include one extra path that was not swept on 10 August:
/../../../../../../root/.unauth/loot-list-v1.canary
Not in the 10 August session. If you use this as a wordlist, skip role=publication-canary. If that path hits our decoy, someone reused the list.
- The decoy is a fake n8n. It never runs what the requester sends. No eval, no shell, no reading the real disk.
- These are the 102 GET paths from that one session, decoded, in the order they arrived.
- No repeats. Time is from the first request to the last.
- At the time, 8 of 102 got a fake file. 94 got the login page. We added more fake files the next day. This list is what they asked for, not what they stole.
- The JSON and CSV have one extra path that was not in the session. Skip it if you use this as a wordlist. If it shows up on our decoy, someone reused the list.
- The Now column is a replay we ran locally on 11 August against the updated decoy. We did not hit the public box again.
CVE-2026-21858 is a public unauthenticated file-read in n8n before 1.121.0. Patch. This page is a request set from one decoy session. It is not that exploit, and it is not a how-to.