Cybercriminals are increasingly targeting local data stored by AI coding agents, including Claude, Cline, Codex, Continue, Cursor, and OpenCode.
Information-stealing malware, commonly called infostealers, is now collecting AI tool tokens, source code, prompt histories, project data, and credentials linked to connected services.
Security researchers found that this is not an experimental trend. Malware families such as Amatera, Remus, CallbackBeaver, BeeStealer, HydraStealer, APEX Stealer, Otter Stealer, and macOS-focused Djinn Stealer have added AI development tools to their collection rules.
Amatera has been observed targeting Cline and Continue data, while Remus targets Claude, Cursor, and OpenCode.
CallbackBeaver has also added Cursor and Claude to its collection scope. Researchers identified more than 5,000 CallbackBeaver samples during a recent 30-day period.
The shift shows that AI-assisted coding platforms have become valuable targets for the wider infostealer ecosystem.
Threat actors can add newly popular AI tools to malware collection lists by updating paths, filenames, or database rules without necessarily rebuilding the malware.
Infostealers Target AI Coding Agents
AI coding agents can store far more than basic application preferences. Depending on the tool and user configuration, local files may include access tokens, refresh tokens, account details, Model Context Protocol (MCP) configurations, API keys, conversation histories, project references, and cached source-code information.
An access token could allow criminals to use a victim’s AI account until it expires. A refresh token may enable them to generate new access tokens, extending unauthorized access. Attackers could abuse paid AI API services, steal usage capacity, or sell working accounts to other criminals.
MCP configurations create an additional risk. MCP allows AI agents to connect with external services, including source-control platforms, databases, cloud environments, ticketing systems, and collaboration tools.
If local configuration files contain reusable API keys, headers, environment variables, or credentials, an infostealer infection could expose systems beyond the AI platform itself.
Prompt histories may be equally valuable. Developers often use AI assistants to review proprietary code, debug incidents, summarize internal documents, analyze logs, and discuss unfinished products.
These conversations can reveal repository names, internal hostnames, infrastructure details, security controls, API secrets, and business plans.
This combination gives attackers both access and context. A stolen browser cookie may open an account, but an AI-agent archive can also reveal which projects are valuable, which systems are connected, and which employees may be vulnerable to targeted phishing or extortion.
Organizations should treat AI-agent data as part of their identity, credential, and endpoint security posture.
Security teams need to inventory the AI tools used across development environments and identify where each tool stores credentials, histories, project data, and MCP configurations, gendigital said.
Developers should avoid placing passwords, private keys, API tokens, customer information, and production secrets into AI prompts.
If a secret was shared during troubleshooting, it should be rotated immediately and removed from retained conversation history where possible.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
