Password-stealing malware now hunts the files AI coding tools leave behind

Malware built to steal passwords is now looking for something new: the files AI coding tools keep on your computer. Security company Gen Digital reported on September 8, 2026 that the target lists of these programs, called infostealers, now include data from Claude, Cursor, Cline, Continue and OpenCode.

What changed

Many stealers get their shopping list from a remote operator. The list names folders, file types and databases to copy. Adding an AI tool means adding one more path, with no need to rebuild the malware. Gen Digital said AI-agent data was appearing in the rules of another stealer almost every day.

One family, CallbackBeaver, added Claude and Cursor and showed up in more than 5,000 samples in 30 days. Two others, Amatera and Remus, were also found with rules for these tools. A stealer called Djinn does the same on Mac and also covers Codex, Gemini and Kilo.

What gets taken

The report sorts the loot into two kinds.

• Access: saved login tokens and keys, including ones in Model Context Protocol settings, which link AI tools to other services.
• Context: prompt histories, saved conversations and a map of the projects someone was working on.

Context matters because chats can hold source code, internal server names and secrets pasted in for troubleshooting. Gen Digital said a single archive can carry both the means to get into an account and the context to see what is worth stealing.

What this does not mean

No new security hole is involved. The malware has to be on the computer already. Gen Digital also said a stolen token does not guarantee lasting access, since that depends on its scope, lifetime and the service's own controls.

The numbers are also detections, not proven break-ins, and the counts for Amatera and Remus may overlap. The record behind the report describes no confirmed account takeover traced to these rules. What is documented is capability and exposure.

What to do

Anyone who uses AI coding tools, or has staff who do, can take a few steps.

• Treat saved logins and chat history in these tools like passwords.
• Keep work computers free of malware.
• Avoid pasting secrets, such as keys or passwords, into AI chats.
• If a device is infected, change the logins that were stored on it.

What happens next

Gen Digital warned that a stealer ignoring a given AI tool today proves little. That is a snapshot, and the tool could be added later. The report also said some tools need extra work to read, so not every stealer can take every file.