Symantec says the Aoki infostealer now steals the credential and session files of AI coding assistants, including Claude, Codex and Cursor

Symantec's Threat Hunter Team, part of Broadcom, published a report on 15 October that begins: “The Aoki (aka Aokigahara) infostealer is now stealing credential and session files used by AI coding assistants, including Claude, OpenAI's Codex, Cursor, Codeium and Gemini.”

The report says the malware targeted Claude's .claude.json file and desktop cookies, ChatGPT cookies, and the Codex config.toml and .env files. It took tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, plus Amazon Web Services credentials, alongside the usual infostealer haul of browser data, crypto wallets and password managers.

Symantec says the malware stole credential, token and session files rather than source code. The one exception it notes is Cursor's local state database, which can cache chat context and code snippets. Those files can let an attacker use a developer's paid AI accounts or reach the code and cloud systems the assistant is connected to.

Symantec says it does not know which group is behind Aoki and has seen no link to any existing malware family. Its indicators list 17 file hashes. The report does not say how the malware reaches victims and gives no victim count.

It is the latest sign that AI agents' keys are becoming a target in their own right: a paper posted the same day scanned 21,097 MCP servers, the plug-ins that give agents tools, for ways to leak files outside their purpose.

• Confirmed Symantec says Aoki “is now stealing credential and session files used by AI coding assistants”, naming Claude, OpenAI's Codex, Cursor, Codeium and Gemini. Symantec Threat Hunter Team
• Confirmed The malware stole credential, token and session files rather than source code; Symantec does not know who is behind it and lists 17 file hashes. Symantec Threat Hunter Team