- Gen Digital says Warden Stealer targets files and data of AI coding tools. Symantec says Aoki targets their credential and session files.
- Symantec says stolen keys and tokens can act as the developer and may reach code, cloud services and build pipelines.
- Ask where AI tools store keys, whether you track them as identities, and how fast you can revoke one.
A password is something a person types. A token is something a machine keeps. Two new infostealers now list AI coding tools among their targets. An infostealer is a program that copies data off an infected computer.
The lesson is that AI assistants add a new kind of identity to a developer's laptop. Some of it is a file that can act as the developer. Ask whether your company tracks it as an identity.
What the reports say
Gen Digital described Warden Stealer. It is written in Rust and sold as malware-as-a-service, which means criminals rent it. Gen Digital called it "one of the first infostealers targeting configuration files and local data belonging to AI assistants and agentic coding tools."
Gen Digital also says the builds are heavily scrambled and regularly updated to evade detection.
Symantec's Threat Hunter team described a different stealer, Aoki, also called Aokigahara. It was first seen earlier this year. Aoki targets credential and session files used by Claude, OpenAI's Codex, Cursor, Codeium and Gemini.
The Hacker News gathered both reports in its October 16, 2026 ThreatsDay bulletin. They come from different vendors. Neither says the two stealers are linked.
The reports also differ in what they claim. Warden is described as targeting configuration files and local data. Only Aoki is described as taking credential files.
How the theft works
AI coding tools must prove who is calling them. They use API keys and OAuth or session tokens. An API key is a long secret string. An OAuth or session token is a temporary pass issued after sign-in.
Symantec says such keys and tokens "allow malicious activity to be carried out under a legitimate developer's identity and API quota." Aoki goes after the files where these credentials sit.
Symantec adds that a stolen key can expose repositories, cloud services and CI/CD pipelines linked to that account. CI/CD pipelines are the automated systems that build and ship software. It says the key may also bypass safeguards that assume a trusted user.
Gen Digital does not say Warden steals keys. Configuration files can sometimes hold secrets. That is our inference, and neither report confirms it. It is still a reason to check what those files contain.
Why a stolen session is worse than it looks
Think of a hotel keycard. The front desk checked your ID once. After that, the door trusts the card, not you. If someone copies the card, the door opens.
That is why session theft matters for MFA, the second login step many firms rely on. Netskope described a different malware family, XWorm. It says a plugin called HBrowser gives operators control of logged-in browser sessions "without touching credentials, bypassing MFA entirely."
MFA protects the moment of sign-in. A stolen live session skips that moment.
Netskope said XWorm moved from an infostealer to a full surveillance platform. That is one malware family. It does not measure the whole market.
The money angle, and what is still unproven
Wiz, owned by Google, published a report last month. It said AI provider API keys are in demand. Attackers can "freely run their own workloads or resell the access as part of the illicit LLM resale market."
For a company, that could mean an unexpected bill or work done in its name. That is our reading of the risk, not a finding from Wiz.
Wiz also said such keys could expose old chat logs with sensitive corporate data. It said it is not aware of public cases of this. The risk is described, not yet documented.
Stolen credentials already cause harm elsewhere. Meta is notifying about 1,500 people after unknown actors broke into some of its GitHub repositories. Most are Meta employees in the U.S. The company detected the break-in a few weeks ago.
SecurityWeek reported that an employee's stolen credentials were used. It said the access has been shut down. Nothing in the reporting links that case to AI tools or to either stealer.
What leaders should ask
Put these questions to your security and engineering leads. Where do our AI coding tools store keys, tokens and configuration files? Who can read them? Is each key tied to one person or shared by a team? Can we revoke one in minutes?
Do we watch for odd use or spending on AI accounts? What could a stolen key reach in our repositories, cloud accounts and build pipelines? Do we list these keys as identities at all?
Also ask whether protection on developer laptops is tuned for stealers. Gen Digital says Warden's builds are regularly updated to evade detection. A one-time check is not enough.
The takeaway is simple. AI tools leave files on the laptop, and some of those files can act as the developer. Treat them like any other login that can touch your code and your cloud.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Hacker News.
