Unverified50% confidenceFactExact time
Writing the attacker's public key into authorized_keys is equivalent to opening a permanent passwordless entry point for the attacker, and it triggers no login alerts.
1
Sources
50%
Confidence
Long-term
Relevance
10/31/2026
First Seen
Sources
Related Claims
UnverifiedThe keychain is not a panacea: once the local account is compromised, an attacker may still be able to invoke the keychain as the current user, so it should be combined with least-privilege IAM users and regular rotation of access keys.77% similarUnverifiedAn agent key is not a brand-new key format, but adds an 'identity marker' layer on top of a Restricted Key, and Stripe automatically binds default approval rules to it.77% similarVerifiedOnce an API Key is leaked, an attacker can make unlimited API calls from anywhere in the world as the key holder, and the server cannot distinguish legitimate calls from unauthorized ones.74% similarUnverifiedThe Cursor Agent SDK provides a security safety net by default: keys are not left exposed in code, and the agent runs in an isolated environment without overstepping into things it should not touch.74% similarUnverifiedUnder a secure boot mechanism, even if an attacker modifies the firmware code, as long as the private key is not leaked, the modified firmware cannot pass signature verification.74% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1118947API
curl https://kongchang.com/api/v1/knowledge/claims/1118947MCP
get_claim(id=1118947)