🔍 Read the full analysis: Could Your AI Tool Sessions Be Vulnerable To Theft? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Three reports dated Oct. 23–26 describe separate risks to AI tools: malware targeting local login and configuration files, a vendor breach affecting some Warp agent telemetry, and a reported OpenAI reasoning-disclosure flaw that researchers say was fixed. The scope and downstream use of the exposed data are not fully known; the incidents point to the sensitivity of AI sessions, credentials and agent logs.
Security researchers and AI companies reported three separate incidents in late October involving data used by AI tools: Check Point Research identified malware targeting AI application login files, Warp disclosed that attackers reached some agent traces through a vendor, and researchers at Xint said OpenAI fixed a flaw that could expose hidden model reasoning. The reports highlight risks to sessions, credentials and agent records, but the incidents have different causes and their full impact remains unclear.
Check Point Research said on Oct. 23 that a malware family it calls Aokigahara includes an “aisessions” module designed to collect authentication, session and configuration files from a range of developer and AI products. Its list includes Claude, Codex, ChatGPT Desktop, Cursor, Windsurf, GitHub Copilot, Gemini CLI and other tools. The report also describes collection of browser data, Git credentials, SSH files and cloud credentials. Check Point said the examined file paths were Windows paths, but did not establish how the malware reaches victims or how many devices are affected.
Warp CEO Zach Lloyd said on Oct. 26 that attackers had compromised a vendor in Warp’s infrastructure and accessed a limited amount of agent trace and telemetry data. Lloyd put the upper bound at roughly 1% of users. That is a maximum estimate, not a confirmed count of affected accounts; the public statement cited in the source material does not specify what individual records were involved or whether they were misused.
Also on Oct. 26, security researchers at Xint said OpenAI had fixed a flaw in its conversation-compaction feature on Oct. 23 and paid a $6,000 bug bounty. Xint said the issue could be steered into making hidden reasoning available as readable text. The source material reports no public OpenAI statement on this specific flaw, so the account of its behavior and resolution is attributable to the researchers, not independently confirmed here.
Infographic 01 · One infostealer, many keys
Your AI tool’s login files are now on the list.
Aokigahara steals the classics, plus a dedicated module for AI tools and a second one for developer and cloud keys. The analyzed paths are Windows paths.
The AI module: “aisessions”
Login, session and settings files the malware looks for. Not every file holds a secret.
Claude Code + Claude DesktopCodexChatGPT DesktopCursorWindsurfKiroCodeiumGitHub CopilotVS CodeGemini CLIJetBrains AI AssistantAmazon QAWS CLI + SSO
It also queries the Windows Credential Manager.
The developer toolbox: “ide”
What lets an attacker move from one laptop to code and cloud.
- Git credential files
- Files in the SSH folder that may contain private keys
- AWS, Azure and Google Cloud credential and config files
- GitHub Copilot storage
The classics
- Browser logins and cookies
- Crypto wallets
- Password manager files
- VPN and FTP settings
- Screenshot and clipboard
Why AI sessions
- Access “without entering a password”
- Private conversations, uploaded code
- Paid usage and account resale
- Extortion with business data (possible)
Not known
- How it reaches victims
- How many machines are infected
- How operators make money (“not confirmed”)
A stolen session is a festival wristband: nobody checks your ticket again. That is why two-factor login does not help once it is gone.Thorsten Meyer · my reading
Source: Check Point Research, 23 Oct 2026 (malware analysis; counts are mine). Naming a tool as a target does not mean its maker was breached.
Powered by Thorsten Meyer AI
The Data Behind AI Sessions
AI tools can hold or process logged-in sessions, API keys, code and agent traces. A stolen session may allow access without repeating the normal login process, while traces can record what an agent read, ran or received as output. The risks differ: local malware may target files on a user’s computer, a vendor compromise can expose data held in a service’s infrastructure, and a software flaw may disclose information through model or product behavior.
These reports do not establish that all AI users or vendors are exposed, or that stolen information was used for fraud. They do show why organizations should treat AI account sessions and agent records as sensitive data, rather than assuming they carry no more risk than ordinary application settings. The practical concern is not limited to AI chat: developer tools may have access to source code, cloud environments and other credentials that can broaden the consequences of a compromised device or account.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
As an affiliate, we earn on qualifying purchases.
Three Incidents, Separate Causes
The reports appeared within days of one another, but they do not describe one coordinated campaign. Aokigahara is malware that Check Point says searches local files; Warp’s disclosure concerns a compromised vendor in its infrastructure; and Xint’s account concerns a flaw in an OpenAI feature. The shared issue is the sensitive information that can accumulate around AI applications, not evidence that the same attackers or vulnerability connect the cases.
Check Point said Aokigahara also targets traditional valuables, including browser logins, cookies, cryptocurrency wallets and password-manager files. Its report does not confirm how the operators monetize the AI data. Separately, an August research paper cited in the source material said researchers decoded 315,320 encrypted reasoning blocks posted in public repositories and identified 367 pieces of personal data and 182 credentials. Those figures concern material in public repositories, not the three incidents reported in October, and do not establish that the data came from OpenAI or any affected user.
“AI application credentials and session data should be treated as sensitive assets alongside browser sessions, cloud credentials and other authentication data.”
— Check Point Research
Scope and Exposure Still Unclear
For Aokigahara, Check Point has not reported the number of infected machines, the route by which the malware reaches them or how its operators use any stolen information. The listed files may not all contain usable secrets, the researchers cautioned, and the report does not establish that every listed application was successfully accessed on an infected device.
For Warp, the public account gives an upper estimate of affected users but does not name the vendor in the source material or detail which traces were accessed, how long the attackers had access or whether any data was copied beyond the reported access. For the OpenAI issue, the reported fix and bounty come from Xint; the source material does not include a company confirmation, a technical advisory or details about any exploitation. It is not clear whether the flaw was used outside testing or whether any user data was exposed.
Vendor Details and User Safeguards
Readers and organizations should watch for further notices from Check Point, Warp and OpenAI that clarify affected systems, records and remediation. Until then, teams can reduce exposure by limiting the lifetime of sessions, using managed devices, keeping API keys and other secrets out of agent prompts and working context, and reviewing what AI providers retain in traces and telemetry. Shorter retention periods can also limit how much agent history remains available after an incident.
Users should follow official security guidance from their AI and device providers, review active sessions where those controls are available, and revoke credentials if a vendor or security notice advises it. These precautions do not confirm that a particular account was compromised. The next meaningful updates will be technical details on the malware’s reach, Warp’s account of the vendor incident and any public explanation from OpenAI about the reported flaw.
Key Questions
Does this mean AI accounts have been stolen?
No. The reports describe malware designed to target AI-related files and separate incidents involving Warp telemetry and a reported OpenAI flaw. They do not establish that every listed account was compromised or that all potentially accessible data was stolen.
Which AI tools did the malware target?
Check Point’s list includes Claude, Codex, ChatGPT Desktop, Cursor, Windsurf, GitHub Copilot and Gemini CLI, among other developer tools. The report identifies file paths, not proof that every product or user was successfully affected.
What did Warp say was accessed?
CEO Zach Lloyd said attackers reached a limited amount of agent trace and telemetry data through a compromised vendor. He gave an upper bound of roughly 1% of users; the source material does not provide a confirmed affected-user count or a full account of the records.
What should users do now?
Use managed devices where possible, keep credentials out of AI prompts and agent context, review session controls, and check official vendor notices. Organizations can also review AI data-retention settings and limit how long agent traces are stored.
Source: ThorstenMeyerAI.com
