Cybercriminals now have off-the-shelf tools with which to hack AI agents and take them over, enabling them to commit financial fraud and other forms of malicious damage on the agents' owners.
According to the research team at cybersecurity firm Symantec: "The Aoki (aka Aokigahara) infostealer is now stealing credential and session files used by AI coding assistants, including Claude, OpenAI's Codex, Cursor, Codeium and Gemini. Earlier versions of the malware did not target AI-related files, which indicates the capability is a recent addition."
Stolen application programming interface (API) keys and tokens can allow attackers to carry out activity under a legitimate user's identity. The Symantec Threat Hunter team found that recent versions of Aoki were designed to harvest credentials and session files for Claude, OpenAI's Codex, Cursor, Codeium and Gemini, alongside the browser, cryptocurrency wallet and password manager data that infostealers typically collect.
As well as the AI-related targets, Aoki attempts to steal a wide range of other information from victims, including Google tokens from a long list of browsers, including Chrome and Firefox. The infostealer also takes information from desktop wallets and from Telegram-related messaging services.
"The capability is recent and appears to be expanding. Aoki is a relatively new stealer that was first seen earlier in 2026. However, older samples did not look for AI-related files, meaning the capability was added to the malware recently," says Symantec.
Aoki also offers a backdoor into corporate systems
By enabling threat actors to bypass safeguards that assume requests originate from a trusted user, the Aoki infostealer poses a question mark over the future security of popular AI agents such as Claude. The dangers of AI agents inadvertently releasing private and confidential information to unaccredited third parties are already well-documented. But the Aoki infostealer adds a new dimension to the security challenge surrounding AI agents.
As well as posing a threat to individual users of off-the-shelf AI agents, the Aoki infostealer also offers cybercriminals a potential back door into corporate systems by hacking into the personal AI accounts of staff who are using them to enhance productivity, often without their companies' knowledge.
According to Deloitte UK, two-thirds of British workers have used the Generative AI tools that create dedicated AI agents for work, spending almost £1 billion a year from their own pockets. Almost a third of them do so without their employer's knowledge, creating a massive security risk of which their IT staff are unaware.
Aokigahara is the name of a famous forest in Japan, but it is not as yet clear if that provides any clues as to the origins of the malware's developers.
