Symantec said on October 15 that the Aoki infostealer has expanded from browser, wallet, and password-manager theft to AI-assistant credentials, including files and tokens tied to Claude, Codex, ChatGPT, Cursor, Gemini, GitHub Copilot, and others. The malware is still in active development, and Symantec has not tied it to a known group.
The steal matters because those saved sessions and keys can make the attacker look like the real developer, spend the victim’s API quota, and reach linked repositories, cloud services, and CI/CD pipelines. In plain terms, Aoki does not need to break the assistant itself if it can reuse the assistant’s standing login material.
For teams that let coding assistants touch source or build systems, the exposure is not limited to the chat app account. A stolen assistant token can become a foothold into the developer’s wider environment, so the downstream blast radius follows the permissions already attached to that login.