Security2 hOctober 15, 2026, 20:00

Aoki Infostealer Now Targets AI Coding Assistant Credentials

Symantec warned that new versions of the Aoki infostealer target credential and session files of popular AI coding assistants, including .claude.json, Claude and ChatGPT cookies, and Codex configs. It also steals tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro, plus AWS credentials.

Infosecurity Magazine

Open source

Aoki Infostealer Now Targets AI Coding Assistant Credentials

Aoki steals .claude.json, Claude and ChatGPT cookies, Codex configs
Targets tokens for Copilot, Cursor, Gemini, JetBrains AI and Kiro
Stolen keys expose repositories, cloud services and CI/CD pipelines
First seen in 2026, the stealer's capabilities are still expanding

#Symantec#Anthropic#OpenAI#Cursor

AI Coding Agents Leak Credentials: Cursor, Claude Code, Copilot and MCP

Security

Prompt injection is the top security risk for AI coding assistants in 2026

Security

Rapuncel Infostealer Disabled 145 Security Tools Before Stealing Credentials

Security

Aoki Infostealer Now Targets AI Coding Assistant Credentials

AI Coding Agents Leak Credentials: Cursor, Claude Code, Copilot and MCP

Prompt injection is the top security risk for AI coding assistants in 2026

Rapuncel Infostealer Disabled 145 Security Tools Before Stealing Credentials

GitGuardian launches AI Hooks to block secrets in Claude Code, Cursor and Codex agents