Infostealers turn to AI-agent data: collection rules now target Claude, Cursor and Codex

On 8 September 2026 Gen Digital published an analysis of information-stealer collection rules and found that the target list has grown a new line: the local data of AI coding agents. Over a three-month window its Windows telemetry recorded Amatera and Remus detections among tens of thousands of protected Windows users — stealers whose rule files now reach into Cline, Continue, Anthropic's Claude, Cursor and OpenCode directories. CallbackBeaver added Claude and Cursor to its collection scope and was observed in more than 5,000 samples in a 30-day period. What gets taken is not preferences but access and context: access and refresh tokens, credentials sitting in Model Context Protocol configurations, prompt histories, conversation databases and a map of the projects a developer was working on. No new flaw is involved — the stealer is already running when the new rule arrives, and the value has moved into predictable local files. This account rests on Gen Digital's report, on Okta's analysis of a stolen-log dump published the same day, and on the Cloud Security Alliance's research note, and the AI incident archive holds this entry alongside its neighbours, each with its own sources, severity and confidence grade.

The archive files the record as a research finding rather than a deployment event: kind research, severity medium, confidence A, disputed false, real_harm false, region GLOBAL, tagged CRED and EXFIL, with a day-precise date of 8 September 2026. That is the day Gen Digital published, not the day any particular machine was infected, and neither report offers an infection date for the rules themselves. The real_harm field is worth reading slowly. Nothing in the record or in its sources describes a confirmed account takeover traced back to these collection rules; what is documented is capability and exposure, which is part of why the entry is graded medium rather than high.

No new flaw: the stealer is already running when the rule arrives

Gen Digital is explicit that it is not describing a vulnerability. Its findings "do not point to a new way of compromising the device or to a vulnerability in an AI model or agent," the report states; the information stealer is already running, and what has changed is "the concentration of valuable information in predictable locations, sometimes in plaintext, and the ease with which those locations can be added to an existing collection list."

That ease is the mechanism. Many stealers receive remotely managed collection rules that specify directories, filenames, extensions, databases, search depth or file-size limits, so an operator who learns where an agent keeps its tokens can add another path without rebuilding or redistributing the malware — and the updated rule reaches installations that are already on compromised machines. Gen Digital attaches two caveats to that: the approach does not apply to every stealer, and some tools need product-specific parsing or decryption rather than a path entry. Its practical warning is about the shape of the evidence — if a major stealer does not collect a particular agent today, that absence is a snapshot, "not as evidence that the agent will remain outside the collection scope."

Which family reaches into which agent

The two families with telemetry behind them are Amatera, targeting data associated with Cline and Continue, and Remus, targeting Claude, Cursor and OpenCode. Gen Digital says the figures for both "may overlap and describe detections rather than successful infections" — a distinction that matters when reading the numbers as a measure of how many developers were actually robbed. Around them sit the families that make the behaviour look like a trend rather than an experiment: BeeStealer, STG Stealer, HydraStealer, APEX Stealer and Otter Stealer, which the report classes as lower-prevalence, and Djinn Stealer, which shows the same behaviour on macOS and is associated with collecting from Claude, Codex, Gemini, Cline, OpenCode and Kilo.

Gen Digital's own summary of the pace is that AI-agent data was appearing "in the collection rules of another stealer almost every day." For scale it puts the targeting inside a much older problem: during the first half of 2026 its telemetry recorded infostealer detections among more than 3.3 million unique protected users, with the monthly figure consistently above 500,000. Those totals cover every infostealer family, not the ones known to touch AI agent data, so they measure the pool the new rules are spreading through rather than the reach of the new rules.

What comes out is a refresh token and a map of the codebase

The report splits what an agent directory holds into two categories, and the split is the substance of the finding. The first is access: some agents cache access tokens or login details locally so a user does not re-authenticate every session. An access token may be usable until it expires; a refresh token can sometimes be exchanged for new access tokens and extend the window. Gen Digital is careful about the limits — the outcome "depends on the token's scope, lifetime, and the service's own controls, so stealing a file does not guarantee lasting access" — while noting the file "can still be as sensitive as a password store."

The second category is context, and it is why this is not simply a credential story. Prompts and transcripts can hold proprietary source code, repository names, internal hostnames and secrets pasted in for troubleshooting; a transcript can hand an attacker the structure of a codebase, known weaknesses and the people involved, which the report describes as reconnaissance "an attacker would otherwise spend days collecting." Where a developer has used an assistant on a confidential proof of concept, the history can expose an unpatented invention. Gen Digital's summary of the combination is that one archive may carry "both the means to access an account and the context needed to understand what is valuable behind it."

Model Context Protocol configurations sit between the two categories. They may contain endpoints, headers, environment variables and API keys, and where reusable secrets are stored locally the compromise can reach source control, ticketing platforms, databases or cloud services the agent was connected to. The report does not overstate it: some integrations use short-lived credentials, OS-protected storage or an interactive authorization flow, so a stolen configuration does not automatically unlock everything it names.

Okta counted the buyer's side of the same market

Okta's threat-intelligence team worked the same problem from the other end, and its report carries an 8 September 2026 publication timestamp too. It analysed a free 7 GB log dump posted to a Telegram channel on 2 August 2026 — 5,871 folders, one per infected machine, spread across 162 countries — using custom regular expressions and the open-source secret scanner TruffleHog. Of 44,791 unique JSON Web Tokens in the dump, 555 were identified as likely tied to AI service authentication. A separate search found 2,937 authentication-related JSON Web Encryption objects, most of them set by OpenAI using NextAuth.js, and 1,843 JWTs and JWEs of all kinds were still unexpired on the day of release.

The per-provider counts are the part that becomes a number a security team can act on. Anthropic accounted for 561 unique session tokens across 404 distinct machines, of which 164 had not expired; Cursor accounted for 32 across 26 machines, of which 16 had not expired. Google and Microsoft dominate the table with 9,829 and 2,491 tokens, but Okta notes those totals pass through single sign-on gateways and span each vendor's full account base, so they are not a measure of AI-specific exposure. TruffleHog also returned 24 still-valid API keys across four AI-related model services — the category Okta describes as a credential a buyer can use to run inference on someone else's bill. Jeremy Kirk, Okta's director of threat intelligence, put the mechanism plainly: session tokens and API keys are sought "because it is often possible to replay those secrets and bypass credential-based authentication."

Okta is careful about what the dump proves. It says it "did not observe evidence of stolen Okta sessions in this data dump," and a stolen token still fails where an organisation enforces IP allowlisting. The financial figures in its introduction — a bill of nearly $1 million for one organisation, $600,000 in AI credits lost by an AI testing organisation through a stolen API key — are cited as separate, previously reported cases, not as damage from this dataset. The Cloud Security Alliance's research note of 11 September 2026 makes the same point explicitly: Okta's analysis describes tokens present in a criminal dump and their theoretical replayability, does not claim to have measured how many were actually exploited, and does not attribute a specific breach to the dump.

The demand side is corroborated from outside Okta as well. The Hacker News reported on 9 September 2026 that Okta had flagged Telegram listings selling discounted access to Claude, Cursor, ChatGPT and Gemini accounts with 24/7 support and money-back guarantees, and that a service branding itself Poison Claude advertised access to Anthropic's Opus 4.6, 4.7 and 4.8 and Sonnet 4.6. Gizmodo covered the same market on 10 September 2026. The Hacker News also carried Google Threat Intelligence Group's assessment that the cost of premium model access is driving "increased targeting, exfiltration, and sale of AI accounts across cybercrime communities," and described a Mandiant incident-response engagement in which a threat actor used an exposed GitHub personal access token to deploy unauthorised AI infrastructure.

What the record does establish, and what no cited source settles

Established, and stated as such by the sources: commodity stealers have added AI coding agent paths to remotely managed collection rules across several families and two operating systems; the local directories can hold tokens, MCP credentials, histories and project metadata; and a large free dump did contain unexpired authentication material for AI services, including 164 unexpired Anthropic session tokens and 24 valid API keys.

• Not established: that any of these rules produced a confirmed account takeover. Neither Gen Digital nor Okta reports a victim whose account was entered with a stolen token from these specific collections, and the archive's real_harm false reflects that gap rather than a denial that harm is possible.

• Not established: how many developers were affected. Gen Digital's Amatera and Remus numbers are detections among protected users, may overlap, and are not infections; Okta's counts describe one 7 GB dump, not the market.

• Not established: which agents store what, by default. Both reports stress that paths, files and protections differ by product, operating system and user configuration, so no single agent can be cleared from this record — Gen Digital's answer is to inventory what is stored locally before assuming any product is safe.

• Not established: what any agent vendor changed. Neither report describes a product change made in response, and neither says a vendor was notified. The only product-side mitigations discussed are generic — OS credential stores, short-lived scoped tokens and retention controls that Gen Digital argues should come from the tools themselves.

• Corrected after publication: the Cloud Security Alliance's note carries a version 1.1 revision dated 11 September 2026, which it says fixed a scale-inflation problem in which Google's and Microsoft's ecosystem-wide sign-on token counts had been presented as AI-specific exposure without Okta's own caveat, along with a misattached citation and two references that could not be confirmed as live.

What changed after: rotations, not password resets

The response both reports converge on is an incident-response change rather than a patch. Gen Digital's guidance is to treat a local authentication file as a password, prefer the operating system keychain or keyring where the product offers the choice, keep secrets out of prompts, give MCP integrations only the permissions they need, and — after a stealer infection — work from a clean device to revoke AI-service sessions and rotate API keys and MCP credentials. Its bluntest line is that "changing browser passwords alone is no longer enough," and that multi-factor authentication may not stop abuse of a session token that has already been stolen.

Okta's controls are the identity-side complement: usage caps and IP allowlisting on API keys, OAuth 2.0 flows that issue short-lived access tokens from a refresh token held in a keychain, monitoring for session-token reuse, and Device-Bound Session Credentials, which cryptographically tie a session to a device. Okta notes DBSC is early — services must implement it server-side — and that Chrome 145 for Windows, released in March 2026, can support it. It also records that Google's App-Bound Encryption, introduced in 2024 to encrypt browser data, was worked around by stealer developers fairly quickly. The Cloud Security Alliance draws the operational conclusion that token revocation, not password reset, is what closes off a stolen live session.

The record stays where its fields put it: a medium-severity research finding, confidence A, undisputed, with no recorded real harm and a single day of publication behind it. What makes it worth keeping is the asymmetry it documents — the cost of adding another agent to a collection list is one configuration update, while the cost of knowing which agents on which machines hold reusable credentials is an inventory most organisations have not taken.