- Symantec found that newer versions of the Aoki infostealer collect sign-in and session files for AI coding assistants, including Claude, Codex, Cursor, Codeium and Gemini.
- Symantec says a stolen token can act as the developer and can expose repositories, cloud services and CI/CD pipelines linked to that account.
- Leaders should ask where assistant tokens are stored on laptops, what each one connects to, and how fast it can be revoked.
A developer's AI assistant login used to be a line on a software bill. Symantec's Threat Hunter team now reports that a data-stealing program called Aoki collects those logins. The reason is what a login can connect to.
What Symantec found
Aoki, also called Aokigahara, first appeared earlier in 2026. Symantec studied several versions. The newer ones look for sign-in and session files from five AI coding tools: Claude, Codex, Cursor, Codeium and Gemini.
Older samples did not look for these files. Symantec says the feature is recent and appears to be growing. The program still does the usual work of an infostealer, with browser data, crypto wallets and password managers on its list.
What the newest version looks for
The latest sample went further. It went after the .claude.json file, Claude desktop cookies and ChatGPT cookies. It also took Codex's config.toml and .env files.
Its token theft reached wider still. Cursor, Kiro, GitHub Copilot, Google Gemini and JetBrains AI Assistant were all affected. So were Amazon Web Services (AWS) cloud credentials.
Symantec says the malware took credential and session files rather than source code. It reports one exception. Cursor's local state database can cache chat context and code snippets.
How the collection works
Aoki has no remote command list. Symantec still calls it highly capable and under active development. It gathers what it finds on the machine and uploads it to the attackers' server. Security teams call this a command-and-control server.
The upload goes to a path named /gate. Most newer samples sent data to one domain. Two newer samples used a separate one. Older samples used a bare IP address and port 8080, over plain unencrypted HTTP.
Why an AI key may be as valuable to thieves as a card number
Symantec says this development suggests AI credentials may be considered just as valuable by attackers as payment card data. Both can turn into money fast. A thief can resell a stolen AI key or run up usage on the victim's account. Symantec says this is sometimes called LLMjacking.
A card number stops there. An AI key can also give a route into the developer's wider environment. Symantec says keys and tokens let an attacker act under the developer's identity and usage quota.
Depending on the account, the tokens can also expose linked repositories, cloud services and CI/CD pipelines. These are the automated systems that build and release software. Symantec adds that they may get around safeguards that trust requests from a known user.
This is the shift for leaders to see. Most companies file an AI assistant seat under software licences. An attacker may see an access credential. A licence is a fixed fee. A credential can reach whatever is connected to that account.
What is not known
Symantec does not know which group is behind Aoki. It sees no links to any existing malware family. The target list leans heavily toward crypto wallets and extensions, which points to a financial motive.
The report does not say how Aoki reaches machines or how many were infected. A security team will want answers to both.
Questions to put to your team
Ask where AI assistant tokens and config files sit on developer laptops. Ask what each token can reach, such as repositories, cloud accounts and build pipelines. Ask how quickly each one can be revoked and replaced.
Ask whether endpoint protection covers developer machines. Ask whether AI accounts have usage alerts. Symantec says its endpoint products detect this family as Infostealer.Aoki, so confirm that detection is switched on.
The lesson: an AI assistant token can be a route into the systems linked to that account, so treat it with the same care as a cloud password.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Symantec (Broadcom).
