Dating note again. Gen Digital published this research on September 8, and the coverage ran through the following week. I’m catching up because Adversa’s October roundup puts it in its standing advice (“rotate the agent tokens that infostealers now target”), and because it’s one of the most practical items in this whole space.

What Gen Digital found: while analyzing the collection rules of recent infostealer malware, researchers found a newer category sitting next to the familiar browser, wallet, and password targets. Local data from Claude, Cline, Codex, Continue, Cursor, OpenCode, and other AI development tools. By family: Amatera focused on Cline and Continue. Remus targeted Claude, Cursor, and OpenCode. The macOS-focused Djinn stealer has been associated with Claude, Codex, Gemini, Cline, OpenCode, and Kilo. Others named as spreading the technique include BeeStealer, STG Stealer, HydraStealer, APEX Stealer, and Otter Stealer.

The key point, stated in the research itself: this isn’t a newly disclosed flaw in a model, an assistant, or an agent framework. The malware has to already be running on your machine. What changed is the shopping list. Agents leave behind access and refresh tokens, credentials stored inside MCP configurations, prompt histories, conversation databases, account identifiers, and the names of the projects you’ve been working on, sometimes in predictable or even plaintext locations.

Why tokens specifically matter: some agents keep tokens locally so you don’t have to log in every session. A stolen access token can be used until it expires. A refresh token can extend that window. The practical outcomes the research lists are paid API abuse and resale of working access. Your agent subscription has become something worth stealing, in the same category as a cloud key.

Other routes to the same files: Android Headlines reported in June that a malicious npm package posing as a Codex UI tool stole authentication tokens from the plaintext auth.json file where Codex stores credentials. A separate campaign, reported by Straiker, used fake Claude Code installers to deliver the ACR Stealer. Different delivery, same targets. It’s the same economy as slopsquatting and the skill-marketplace attacks: attackers go where the access is.

What to do:

  • Treat agent tokens like cloud keys. They belong in your credential rotation plan.
  • If you think a machine was infected, work from a clean system: revoke AI-service sessions, rotate API keys and any credentials held in MCP configs, review activity on agent-linked accounts, and think through whether local conversations or project files exposed anything confidential. That’s the incident-response guidance in the coverage.
  • Install agents only from the vendor’s official source. Fake installers are an active route.
  • My addition, not from the research: if you bring your own API key, that key sits on your machine, which makes it exactly the kind of file this malware looks for. Prefer scoped or short-lived keys where your provider offers them, and keep credentials out of MCP config files when there’s another option.

One honest caveat on numbers. The statistics in the coverage describe the whole infostealer landscape, not only the families that target agents, so I’m not quoting infection counts. What’s established is the targeting itself: collection rules that now include agent files. That’s enough reason to treat those files as sensitive.