Your Engineers AI Coding Sessions Are Already for Sale. MFA Won't Stop the Buyer.
Infostealer malware now harvests live authentication tokens from AI coding agents like Claude, Cursor and Codex. Two September 2026 research reports show why multi-factor authentication does nothing to stop a replayed session token.
Stolen tokens don't need a password, and yours might already be sitting in a Telegram dump.
Infostealer malware used to chase browser passwords and crypto wallets. This year it started chasing something more valuable: the live authentication tokens sitting quietly on your engineers' laptops, next to Claude, Cursor, Copilot and every other AI coding tool they use daily.
Two independent research reports published this week show how far that shift has gone, and why the usual defense, multi-factor authentication, does nothing to stop it.
The New Target: Whatever Your AI Agent Remembers
Security researchers at Gen Digital, Norton's parent company, published findings on September 8, 2026 showing that commodity infostealers have added AI development tools to their standard collection routines. The families doing it are not exotic:
- Amatera
- Remus
- BeeStealer
- HydraStealer
- APEX Stealer
- Otter Stealer
- Djinn Stealer, which focuses on macOS
What they collect from is the set of tools your team already lives in:
- Claude and Codex
- Cursor and Continue
- Cline and OpenCode
3.3M+
unique users with infostealer detections in the first half of 2026
500K+
detections logged per month
6
AI coding tools named in the collection routines
Where these agents cache reusable secrets locally, a single infected laptop can expose far more than one login.
A Replay Attack That Skips the Login Screen Entirely
A day later, on September 9, identity security vendor Okta published its own analysis of a 7GB infostealer dump that surfaced on a Telegram channel on August 2, 2026. The dump held data from 5,871 infected machines across 162 countries.
Out of 44,791 unique JSON web tokens in that dump, Okta's team flagged 555 as tied specifically to AI services. Nearly 3,000 more were encrypted token structures set mostly by OpenAI's login flow.
The services represented span the whole stack a developer touches:
- AI vendors, including Anthropic and OpenAI
- Cloud and identity platforms: Google, Microsoft, Amazon
- Agent and workspace tools: Notion, Cursor, Character.ai, Poe.com
A stolen session token doesn't ask for a password or a one-time code. It just gets replayed, and the service treats the attacker as an already-authenticated user.
That is the mechanic that matters. MFA protects the login. It does nothing once a valid, unexpired token already exists outside that login.
Where These Tokens Actually Live on a Developer's Laptop
Coding agents are attractive targets precisely because of what they accumulate during normal use:
- Long-lived API keys and OAuth tokens, stored in local config directories so the agent doesn't re-authenticate every session
- Prompt and command histories, which often contain pasted credentials, internal URLs, or proprietary source snippets
- Cached project context, including source code and ticket references pulled in for the agent to reason over
- Connected-tool sessions, since many agents hold live credentials for source control, cloud platforms and ticketing systems, not just the AI vendor itself
Commodity infostealers already know where to look. macOS variants target ~/Library/Application Support, while others walk the known config paths for each tool above.
What This Costs If It Goes Unnoticed
The blast radius rarely stops at the AI vendor's own login. Where a coding agent holds live credentials to other systems, one compromised token can reach further:
| Connected system | What an attacker gains |
|---|---|
| Source control | Repository access, and the ability to inject code |
| Ticketing platforms | Internal project and client detail exposure |
| Cloud services | Lateral movement into production infrastructure |
| Collaboration tools | Further credential and message harvesting |
WHY ROTATION MISSES THIS
The token was never technically stolen from a password manager, so a standard credential rotation policy never flags it. It was harvested from a place nobody was watching: the agent's own local state.
Closing the Gap Before the Token Leaves the Laptop
None of this requires a sophisticated attacker. It requires an unmonitored laptop, a commodity infostealer, and a token nobody scoped or expired. Treating AI agent credentials with the same discipline as any other production secret starts here:
- Replace long-lived keys with short-lived, narrowly scoped tokens
- Inventory every system a coding agent can actually reach, not just the ones it was provisioned for
- Test agent workflows and tool integrations continuously, rather than once at rollout
- Insist on verified, reproducible findings instead of a checklist someone signs off on annually
That is the gap EnGenious's AI Security and Evaluation work is built to close, scoring agent workflows and tool integrations against OWASP AIVSS and turning what an infostealer would find into a fixed control before it becomes an incident.
