Abstract: A method for reducing the risk of unexpected or unintended actions during a Remote Desktop Protocol (RDP) or SSH (Secure Shell) session by automatically detecting anomalies using vaulted credentials. The method includes initiating a RDP/SSH session on a server and taking screenshots of the session. The screenshots are sent to a system that uses a computer vision algorithm to transcribe the screen information into a text-based transcription of the session. The text-based transcription of the session recording is then provided to a pre-trained LLM which is prompted to look for anomalies using in-context learning. The detected anomalies are presented to a system administrator or sent as alerts to the system administrator.