🔍 Read the full analysis: Attackers Now Go After Your AI Tools: Stolen Sessions, Leaked Agent Logs And Hidden Reasoning on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Check Point Research reported that the Aokigahara infostealer targets authentication and configuration files used by several AI tools. Separately, Warp’s CEO said attackers accessed limited agent trace and telemetry data through a vendor, while researchers at Xint say OpenAI fixed a hidden-reasoning exposure flaw. The scale and full impact of the incidents are not yet clear.
Three security reports published or disclosed around October 23 describe attackers targeting AI tools and related data: Check Point Research identified malware that collects AI applications’ login files, Warp said a vendor breach exposed limited agent traces and telemetry, and researchers at Xint reported that OpenAI fixed a flaw involving hidden model reasoning. The incidents affect different systems, and their scale and consequences remain partly unclear.
Check Point Research’s October 23 analysis describes an infostealer called Aokigahara, which collects browser credentials and other files as well as authentication, session and configuration data associated with AI tools. Its listed targets include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI, among other developer products. The report also describes collection of Git credentials, SSH-related files and cloud-service credential files. It does not establish that every targeted file contains a usable secret or explain how the malware reaches victims.
Warp CEO Zach Lloyd said attackers exploited a vendor in Warp’s infrastructure and accessed a limited amount of agent trace and telemetry data. Lloyd put the upper bound of potentially affected users at roughly 1%. The information available in the source material is a statement by the CEO on X dated October 26; it does not include a detailed incident report or a description of what specific trace contents were accessed.
Researchers at Xint said OpenAI fixed a flaw on October 23 that could allow its conversation-compaction feature to expose hidden reasoning in readable text. Xint said OpenAI paid a $6,000 bounty. The source material says it found no public statement from OpenAI about this specific issue, so the account of the flaw and fix is attributed to the researchers rather than independently confirmed by the company.
Infographic 01 · One infostealer, many keys
Your AI tool’s login files are now on the list.
Aokigahara steals the classics, plus a dedicated module for AI tools and a second one for developer and cloud keys. The analyzed paths are Windows paths.
The AI module: “aisessions”
Login, session and settings files the malware looks for. Not every file holds a secret.
Claude Code + Claude DesktopCodexChatGPT DesktopCursorWindsurfKiroCodeiumGitHub CopilotVS CodeGemini CLIJetBrains AI AssistantAmazon QAWS CLI + SSO
It also queries the Windows Credential Manager.
The developer toolbox: “ide”
What lets an attacker move from one laptop to code and cloud.
- Git credential files
- Files in the SSH folder that may contain private keys
- AWS, Azure and Google Cloud credential and config files
- GitHub Copilot storage
The classics
- Browser logins and cookies
- Crypto wallets
- Password manager files
- VPN and FTP settings
- Screenshot and clipboard
Why AI sessions
- Access “without entering a password”
- Private conversations, uploaded code
- Paid usage and account resale
- Extortion with business data (possible)
Not known
- How it reaches victims
- How many machines are infected
- How operators make money (“not confirmed”)
A stolen session is a festival wristband: nobody checks your ticket again. That is why two-factor login does not help once it is gone.Thorsten Meyer · my reading
Source: Check Point Research, 23 Oct 2026 (malware analysis; counts are mine). Naming a tool as a target does not mean its maker was breached.
Powered by Thorsten Meyer AI
AI Sessions Become Valuable Targets
The reports point to several kinds of information that may pass through AI tools: logged-in sessions, developer credentials, code and agent activity records. A stolen session could potentially give an attacker access to an account without repeating the original login, while exposed traces could reveal information an agent read or produced. These are risks described by the reports, not confirmed outcomes in every incident.
The practical concern for organizations is that AI tools can connect to internal repositories, cloud accounts and business data. Security teams may need to treat their session files and traces as sensitive alongside browser cookies, passwords and API keys. Access controls, short retention and careful handling of credentials can limit exposure, but the incidents do not establish that any particular company’s data was misused.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
As an affiliate, we earn on qualifying purchases.
Three Different Exposure Paths
The reports concern distinct points in the AI workflow. Aokigahara operates on a user’s computer and, according to Check Point, searches for files associated with AI applications and developer tools. Warp’s disclosure concerns information held in or handled by a vendor in its infrastructure. The Xint report describes a flaw in how a model service handled hidden reasoning during conversation compaction. The cases should not be treated as one coordinated attack or as evidence of a shared perpetrator.
Check Point describes Aokigahara as an infostealer that also targets familiar categories such as browser logins, cookies, cryptocurrency wallets and messaging data. Its report says the malware includes an “aisessions” module. Researchers at Xint separately said an August paper by Panfilov and colleagues decoded 315,320 encrypted reasoning blocks published in public repositories and found 367 pieces of personal data and 182 credentials. Those figures refer to that paper’s dataset; they do not measure the prevalence of exposed data across AI services.
“AI application credentials and session data should be treated as sensitive assets alongside browser sessions, cloud credentials, and other authentication material.”
— Check Point Research
Scope and Impact Still Unclear
Several basic details are not established in the available reports. Check Point does not say how Aokigahara is distributed, how many devices it has infected or whether stolen AI sessions have been used. It also cautions that not every file in its target list necessarily contains a secret and says its analysis does not confirm how operators monetize stolen information.
Warp’s stated upper bound of roughly 1% of users is not a confirmed count of affected accounts, and the available statement does not specify which trace fields were accessed or whether the data was used. For the OpenAI issue, the flaw, fix and bounty are described by Xint; the supplied material includes no public OpenAI account or technical details sufficient to assess exposure. It is also unclear whether any users’ hidden reasoning was actually disclosed.
Incident Details and User Protections
Organizations using the affected tools can review whether AI session files and developer credentials are stored on managed devices, limit access to repositories and cloud accounts, and rotate credentials if there is evidence they were exposed. They can also check what agent traces their providers retain, who can access them and how long they remain available. These are precautionary steps; the reports do not establish that all users need to reset credentials.
Users and security teams should watch for more technical details from Check Point, Warp and OpenAI, including information on infection methods, the affected Warp data fields and the reported OpenAI fix. Until those details are available, the confirmed record remains limited: Check Point documented malware targeting AI-related files, Warp disclosed vendor-mediated access to a limited amount of data, and Xint reported a flaw it says OpenAI fixed.
Key Questions
Which AI tools does the reported malware target?
Check Point lists authentication, session and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI, among other AI and developer tools. A listed file is not necessarily a usable credential.
Did Aokigahara steal AI account sessions from confirmed victims?
Check Point’s analysis describes files the malware is designed to collect, but the source material gives no confirmed victim count and does not establish that stolen sessions were used.
What information was involved in the Warp incident?
Warp CEO Zach Lloyd said a vendor breach gave attackers access to a limited amount of agent trace and telemetry data, with an upper bound of roughly 1% of users potentially affected. The specific contents have not been detailed in the supplied material.
Did OpenAI confirm the hidden-reasoning flaw?
The supplied account comes from Xint researchers, who said OpenAI fixed the issue on October 23 and paid a $6,000 bounty. The source material says it found no public OpenAI statement about this specific flaw.
What should organizations do now?
Review access to AI sessions, developer credentials and cloud keys; check provider policies for agent-trace collection and retention; and rotate credentials if there is evidence of exposure. The reports do not say that every user’s account was compromised.
Source: ThorstenMeyerAI.com
