Commodity infostealers now collect your coding agent's local state — Gen Digital telemetry shows Amatera, Remus, CallbackBeaver, Djinn and five other families grabbing access/refresh tokens, MCP configs, conversation databases and prompt histories from Claude, Cursor, Codex, Cline, Continue, OpenCode, Gemini and Kilo installs

View raw markdownEdit on GitHub ↗

TL;DR

Gen Digital's threat research (2026-09-08, a three-month Windows telemetry window plus macOS samples) reports that mainstream infostealer families have added AI coding agents to their collection lists next to browsers and crypto wallets: Amatera targets Cline and Continue; Remus targets Claude, Cursor and OpenCode; CallbackBeaver added Cursor and Claude (5,000+ samples in 30 days); BeeStealer, STG Stealer, HydraStealer, APEX Stealer and Otter Stealer are adopting the same rules, with "new AI agent collection rules appearing almost every day"; on macOS, Djinn Stealer collects from Claude, Codex, Gemini, Cline, OpenCode and Kilo. What they take is the agent's local state: access and refresh tokens, account and subscription identifiers, MCP configuration files (endpoints, headers, env vars and API keys for every connected tool), conversation databases and prompt histories, recently accessed files and project names — "both the means to access an account and the context needed to understand what is valuable behind it." Gen counted over 3.3 million protected users hitting infostealers in H1 2026. This is the collection side of the market Okta and Anthropic described (stolen Claude sessions); the fix is the same — short-lived scoped tokens, OS credential stores instead of files, nothing secret pasted into a prompt.

What happened

The finding. Gen Digital (Norton/Avast/AVG telemetry): "The findings concern locally installed development agents, not a direct compromise of an AI model or agent." Over three months of Windows detections the researchers watched stealer families add dedicated collection routines for AI development tools, each naming the directories and files that specific agents write. The families and targets, as Gen lists them:

Family Targets
Amatera Cline, Continue
Remus Claude, Cursor, OpenCode
CallbackBeaver Cursor, Claude (5,000+ samples in a 30-day window)
BeeStealer, STG Stealer, HydraStealer, APEX Stealer, Otter Stealer adopting AI-agent rules
Djinn Stealer (macOS) Claude, Codex, Gemini, Cline, OpenCode, Kilo

What the local state contains. Gen's inventory of what a stealer archive from a developer machine now holds: access and refresh tokens; account identifiers, organisation ids and subscription information; MCP configuration files ("endpoints, headers, environment variables, API keys, or other authentication details for external tools," meaning "reusable secrets could expose source control, ticketing, databases, cloud resources, or collaboration services connected to the agent"); prompt histories and transcripts (developers "examine code, analyze logs, and solve incidents" in chat, so histories "may reveal source code, internal hostnames, repository names, deployment details, or secrets pasted during troubleshooting"); recently accessed files and project names. Gen's line: "In one archive, an attacker may obtain both the means to access an account and the context needed to understand what is valuable behind it."

Why this is different from the browser-cookie era. A browser session gets you one SaaS account. An agent's token gets you the agent's paid usage (the Anthropic warning was about exactly that drain), its MCP config gets you every system the agent was wired to — the GitLab MCP PAT theft and Claude Code MCP OAuth hijack entries show what one MCP credential is worth — and its history tells the buyer which repo, host and secret to try first. Okta's analysis of a 5,871-machine stealer dump (logged 2026-09-12) already found replayable Anthropic, Cursor and OpenAI tokens for sale; Gen's report shows the harvesters that fill those dumps being updated for the purpose.

Scale and confidence. Gen reports monthly infostealer detections above 500,000 across its base and 3.3M+ affected users in H1 2026; the per-family AI-agent figures are Gen's own telemetry and are single-sourced by nature (vendor detection data). Cyber Security News (2026-09-09) and GBHackers republished the findings; The Hacker News' 2026-09-17 ThreatsDay roundup carried them as "Amatera and Remus malware now collecting access tokens, MCP configs, prompt histories from Cline, Continue, Claude, Cursor tools." Status ongoing: this is a standing capability in commodity malware, not an incident with an end.

Am I affected?

If a machine that runs any of the listed agents had an infostealer infection (fake installer, cracked software, malicious npm/PyPI package, "free desktop app" ZIP), assume the agent's tokens and MCP configuration were taken. Know where your agents keep state:

# Where the agents' tokens / MCP configs / histories live (inspect permissions and contents; do not paste these into a chat)
ls -la ~/.claude/ ~/.claude.json ~/.cursor/ ~/.codex/ ~/.config/opencode/ ~/.gemini/ ~/.continue/ 2>/dev/null
ls -la ~/Library/Application\ Support/Claude/ ~/Library/Application\ Support/Cursor/User/globalStorage/ 2>/dev/null   # macOS
# MCP configs that hold secrets in plain text:
grep -l -iE 'token|api[_-]?key|secret|password' ~/.claude.json ~/.cursor/mcp.json ~/.codex/config.toml .mcp.json 2>/dev/null
# Cline / Continue (VS Code globalStorage) on macOS / Linux:
ls ~/.vscode/extensions/ 2>/dev/null | grep -iE 'cline|continue'

If you are affected

  • Revoke the agent's sessions from the vendor console (Anthropic, OpenAI, Cursor, Google) and sign back in; rotate every key referenced in MCP configuration files — that list is the blast radius. playbooks/if-an-mcp-server-was-malicious.md has the MCP credential inventory steps; playbooks/rotating-cloud-credentials.md and playbooks/if-your-github-pat-leaked.md for what those configs usually point at.
  • Read your own recent prompt history as an attacker would: any secret, hostname or customer data pasted there is now exposed and needs rotating or notifying.
  • Clean or reimage the endpoint first; rotated credentials on an infected machine are stolen again.

Prevention

Update 2026-10-16 — two more families publish the module: Warden (Gen, 2026-10-08) is CallbackBeaver renamed and sold as a service, and Aoki (Symantec, 2026-10-15) adds Claude, Codex, ChatGPT, Cursor, Codeium, Gemini, Copilot, JetBrains AI Assistant and Kiro files

Two vendor reports in eight days, each from one vendor's telemetry, each a different family, both pointing at the same directories.

  1. Warden Stealer (Gen Threat Labs, 2026-10-08, Vojtěch Krejsa and Jan Rubín). The family Gen tracked as CallbackBeaver in the September report above now sells as Warden, a Rust malware-as-a-service with its own loader and a clipboard address-swapper for ten cryptocurrency networks. Gen calls it one of the most prevalent stealers in its user base. The AI collection became an official module in version 1.9, after operators had been doing it with custom rules: for Claude, Codex, Grok and Cursor it takes access and refresh tokens, credentials held in MCP configurations, prompt histories, conversation databases and the traces of which projects a developer worked on. Delivery is the operator's choice (cracked software, game cheats, malvertising, ClickFix pages); it runs on Windows 8 through 11 and stops reporting when it detects a virtual machine. Gen's behavioural signals for defenders: an unexpected process reading the AI tools' configuration directories and the browser credential stores; certutil.exe -urlcache downloads into %TEMP%; msiexec or cmd.exe started from a temporary directory through the Shell.Application COM object; read-write-execute allocation in another process, usually explorer.exe, followed by remote thread creation. The post reports the authors' pricing and a customer count as the authors' claims; this file does not repeat the figures.
  2. Aoki (Symantec Threat Hunter Team, 2026-10-15). A stealer first seen earlier in 2026 whose older samples took nothing AI-related; recent builds collect the Claude configuration file and Claude desktop cookies, the Codex configuration file and .env files, ChatGPT cookies, and credential or session files for Cursor, Codeium, Google Gemini, GitHub Copilot, JetBrains AI Assistant and Kiro, alongside AWS credentials, browser data, wallets, password managers, Discord and Telegram sessions and mail-client credentials, and it records which security products are installed. Symantec does not describe the delivery vector; the registry artefacts it lists point at Windows. Its stated consequences are the ones this file already carries: resale or metered use of the victim's provider account, and tokens that reach repositories, cloud services and CI pipelines while looking like the user. Detection name: Infostealer.Aoki. Symantec publishes an indicator list; it is not reproduced here.

The Hacker News's ThreatsDay roundup of 2026-10-15 carries both items as one-line pickups of the same two reports, so each family rests on one primary. The shape is now common enough across vendors (Gen's nine families in September, Kynx's dedicated module reported elsewhere, these two) that the finding is confirmed at the class level even where the family count is single-source. Status stays ongoing; the "Am I affected?" paths above are unchanged, with two additions: Codex .env files in project directories and the JetBrains AI Assistant and Kiro stores are now named targets. The response is the same: clean the host first, then rotate every agent token and MCP-held secret, then check provider usage logs for metered activity you did not run.

Sources