Infostealers are malware that quietly harvest saved logins, cookies, and wallet data from an infected computer and send them to an attacker. Security vendors now report that some of these tools have added a new category to their shopping list: the credential and session files that AI coding assistants keep on developers' machines.

The reports describe a change in what is collected, not a new way of breaking into devices or a flaw in any AI model. That distinction matters for how developers should respond.

What Is Being Taken and Why It Is Valuable

Symantec's Threat Hunter Team reported on October 15, 2026, that newer builds of the Aoki infostealer (also called Aokigahara) collect credential and session files for AI coding tools. Named products include Claude, OpenAI Codex, Cursor, Codeium, and Google Gemini. Other reporting on Aoki also lists GitHub Copilot, JetBrains AI Assistant, and Kiro, along with AWS credentials. The date when Aoki first began targeting these tools was not stated in the material available.

Aoki is not the only family showing interest. Gen Digital says recent collection rules cover local data from Claude, Cline, Codex, Continue, Cursor, OpenCode, and similar tools. Google Cloud's Threat Intelligence Group reports that operators of LUMMAC.V2, STEALC.V2, VIDAR, and ACRSTEALER issued commands showing interest in AI developer configurations, going beyond the older practice of grabbing AI-related browser profiles.

The files are attractive for several reasons:

  • Account access: a stolen token or session can let an attacker use someone's AI account without knowing the password.
  • Resale and LLMjacking: Symantec says stolen AI credentials may be resold or used to reach accounts, a practice called LLMjacking, where someone else's paid model access is used and billed to the victim.
  • Wider reach: Check Point notes that AI authentication files and session data may expose credentials for source-code repositories, cloud resources, and other development services.

How This Fits Into Existing Infostealer Behavior

Infostealers already work by scanning known locations on disk for files that hold secrets, such as browser profile folders, wallet files, and password-manager data. Adding AI assistants means adding more paths to that list. AI coding tools store tokens and configuration locally so users do not have to sign in every time, and those files are readable by any process running as the same user.

This is why Gen Digital stresses that its findings concern locally installed coding agents and developer tools. They do not point to a new compromise technique or to an AI-model vulnerability. The malware must already be running on the machine, typically after the user runs a trojanized download or a malicious installer.

Developer machines make a particularly rich target. A single laptop may hold AI tokens, cloud keys, source-control logins, and SSH keys. A stealer that gathers all of them in one pass gives an attacker several ways into a company's systems.

A Microsoft report published on October 23, 2026, on the LiteLLM 1.107.0 supply-chain compromise describes a credential collector with a similar appetite. It targeted AI coding-tool tokens alongside model-provider keys, cloud and workload credentials, CI/CD secrets, source-control and registry tokens, SSH and GPG keys, and browser sessions. This was a compromised software package, not an infostealer campaign aimed specifically at AI assistants, but it shows that AI tool tokens are now treated as standard loot.

Practical Steps and Open Questions

Because the exposure comes from local files, the defenses are mostly familiar hygiene, applied to a new place.

  • Sign out of AI assistants on machines you no longer use, and revoke sessions and tokens from the provider's account settings.
  • Rotate AI, cloud, and source-control credentials if a machine may have been infected. Assume anything stored locally was exposed.
  • Prefer short-lived tokens and narrowly scoped keys over long-lived, all-purpose ones.
  • Avoid keeping API keys in plain-text configuration files or shell profiles where a stealer can sweep them up.
  • Watch usage and billing dashboards for unexpected activity, which can reveal LLMjacking.
  • Install software only from trusted sources, and treat cracked tools and unfamiliar installers as the likely route for infostealers.

Several questions remain open. The reports do not say how widely the new collection has succeeded, how much stolen AI access is being sold, or when each family began targeting these tools. The lists of affected products also differ between vendors, which probably reflects different malware builds and different analysis rather than a definitive inventory.

Conclusion

AI coding assistants have become another place where developers store valuable secrets, and infostealer authors have noticed. Aoki and other families now collect their credential and session files alongside browser data, wallets, and cloud keys.

The threat is not a flaw in the assistants themselves but the old problem of malware reading local files. Treating AI tokens like any other sensitive developer credential, with limited scope, regular rotation, and prompt revocation, is the sensible response.