Unverified50% confidenceEventExact time
Symantec reported on October 15 that the Aoki infostealer has expanded its targets to AI coding tool credentials, including Claude's `.claude.json` and desktop cookies, Codex's `config.toml` and `.env` files, Cursor's local state database, tokens for GitHub Copilot, Gemini, Codeium, JetBrains AI Assistant and Kiro, as well as ChatGPT cookies and AWS credentials.
1
Sources
50%
Confidence
Short-term (~14 days)
Relevance
10/19/2026
First Seen
Valid until: 11/2/2026
Sources
Related Entities
Related Claims
UnverifiedSymantec's threat hunter team released a report stating that an information-stealing trojan (Infostealer) named Aoki has added, in its latest samples, the ability to target the credential files of AI coding assistants.72% similarUnverifiedManifold Security disclosed 8 vulnerabilities across 7 AI coding agents including Claude Code, Codex, and Cursor, which attackers can exploit through malicious configurations to induce the agents to execute programs.68% similarUnverifiedFor incomplete Enigma ciphertexts the algorithm is known and only the key is missing, whereas for the Voynich Manuscript even the encoding system itself is a mystery, representing two distinct types of challenges for AI-assisted cryptography.65% similarVerifiedAttackers can exploit stolen AI service account credentials to call API interfaces for computing power theft, and such behavior has frequently appeared in terms-of-service violation reports on platforms such as OpenAI and Anthropic.64% similarUnverifiedThe CVE-2026-90970 vulnerability exists in the GitLab AI Gateway component and allows authenticated users with access to the Duo Agent Platform to escape the prompt template sandbox via a specially crafted workflow configuration, thereby executing arbitrary commands on the AI Gateway.64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1072353API
curl https://kongchang.com/api/v1/knowledge/claims/1072353MCP
get_claim(id=1072353)