Run data and analysis code for "How Credentials Leak from 'Safe' LLM Coding Agents: An Attack-Surface Measurement"

Per-run results and analysis code behind every rate reported in the paper "How Credentials Leak from 'Safe' LLM Coding Agents: An Attack-Surface Measurement" (under review, Springer Cybersecurity). The study measures whether an indirect prompt injection can drive an LLM coding agent to complete credential exfiltration, not merely whether it is redirected, as a function of the channel the injection arrives through, across 16 agents from five vendors. All measurements are the undefended baseline (no runtime judge, filter, or approval gate). Each result file is one cell containing every repetition in runs[] with the full turn-by-turn transcript (assistant text and tool calls with inputs and outputs) and per-run signals: exfiltrationDetected (with egressChannel), maliciousArtifactEmitted, scriptAudited, and payloadDelivered. Contents: - 01-injection-map/ — the 16 × 8 channel map (Table 3) and the within-channel T4 concealment sweep, organised by channel then model.- 03-egress-axis/ — the five-way egress axis (README-delivered and command-output-delivered), the delayed-trigger variants, and the off-account external-canary collector log.- 04-hygiene/ — the three coupling vectors: execution (T-STAGE), install (T-SLOP), and output (T-EMIT) hygiene.- 05-temit-precision-audit/ — the output-hygiene detector-precision audit: the stratified 45-blob sample, the blind labels, an author-verified human relabel (human_labels.json), and the precision-corrected per-model counts.- scripts/ — the crossed random-effects logistic model / deviance decomposition (r2_1_variance_decomp.py) and the false-positive classifier (temit-fp-classify.mjs).- per-cell-counts.csv — the per-cell aggregate underlying every reported rate; README.md maps each paper table and figure to its data. Ethics and safety: all experiments use a synthetic canary credential (.env.test) and a collector bound to localhost; no production system, third-party service, or real secret was accessed. Canary strings (CANARY-*, AKIACANARY, sk-ant-CANARY, sk_live_CANARY) are the planted test secrets and are expected throughout the transcripts. Internal hostnames, endpoint identifiers, and source IP addresses that incidentally appeared in the test environment have been redacted. Caveats (see the paper's Limitations and the README): the external-canary results (the image-GET validity check and the Gemini T-SLOP split) are scored from the collector's server-side log, included here, rather than the in-harness canary; the Gemini column is on a preview endpoint (gemini-3.1-pro-preview, Vertex global, probed August 2026) and is not decoding-matched to the other frontier models.