Malicious actors are increasingly using info-stealing malware to access local data from popular AI coding agents like Claude, Cursor, Codex and others. Rather than exploiting fresh vulnerabilities in these tools, attackers are retooling existing stealers to harvest sensitive files stored in predictable folders on infected machines.
Security researchers at Gen Digital uncovered this trend after analyzing recent malware activity. The danger isn’t that the models themselves are compromised—it’s that their locally stored artifacts—authentication tokens, connection info, prompt histories, project files—are an easy target if a machine is already infected.
Growing Infostealer Activity
Over a recent three-month window, two malware families—Amatera and Remus—were observed targeting coding agent data. Amatera focused on agents like Cline and Continue, while Remus went after Claude, Cursor and OpenCode. Meanwhile, CallbackBeaver has also expanded its scope; over 5,000 incidents targeting Cursor and Claude were recorded in just one month.
Other infostealers such as BeeStealer, STG Stealer, HydraStealer, APEX, and Otter have followed suit. On macOS, tools like Djinn Stealer are tracking artifacts from Claude, Codex, Gemini, Cline, OpenCode and Kilo. These agents’ local folders often contain more than just settings; they may include conversation logs, connected-service credentials, environment configurations, API keys and refresh tokens.
The Risks of Stolen Agent Data
Access tokens stored locally can allow attackers to impersonate the user until the token expires; refresh tokens can extend that attack window. In many setups, projects or tools linked through these agents carry secrets—API keys, headers, environment variables—that can open paths into code repositories, cloud platforms or other internal infrastructure.
Prompt histories can reveal internal names, troubleshooting steps, snippets of private code or configurations. All of this gives attackers context to mount phishing campaigns, infiltrate related systems, or monetize access by selling credentials.
Defensive Measures
Gen Digital advises organizations to take several steps: maintain an inventory of coding agents in use, audit what data agents store locally, and use credential storage mechanisms provided by the operating system. It’s critical to avoid embedding sensitive information in prompts, grant agents only the minimum necessary permissions, and use short-lived tokens wherever possible.
In case of a suspected infostealer infection, responders should switch to a clean device to revoke sessions, rotate keys and other credentials, and assess whether any agent-based conversations exposed company data. While multifactor authentication provides a safety net, it may not stop misuse of tokens already copied. Also, ensure software is patched, avoid cracked or unauthorized apps, and distrust “ClickFix” or “FakeCaptcha”-style social engineering tricks used to deliver malware.
For organizations deploying AI coding agents at scale, establishing strict policies on approved tools, understanding project access boundaries, and monitoring agent permissions are increasingly essential as adoption grows.
Analysis: What makes this shift so concerning is how small changes in stealer configurations dramatically expand attack surface without needing new exploits. As teams lean more on local agents for development, logs, testing and deployment, the value of agent artifacts grows. What was once low-risk now becomes an exploitable treasure trove. Watching how credential storage, token lifetimes, and permissions evolve will be critical in preventing greater fallout.
