aiqbench analysis
This report highlights how cybercriminals are adapting existing infostealers to harvest sensitive local data—such as API tokens and prompt histories—from AI coding agents like Cursor and Claude on compromised endpoints. The threat stems from the predictable storage locations of these tools rather than a vulnerability within the AI models themselves, signaling that agent adoption expands the attack surface for credential theft without requiring new exploits.
Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories

Cybercriminals are widening the reach of information-stealing malware by targeting the local data created by AI coding agents. The shift puts access tokens, saved connections, prompt histories, and project records at risk on already infected computers. The activity does not point to a newly discovered flaw in Claude, Cursor, or Codex. Instead, it shows criminals […] The post Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories appeared first on Cyber Security News.
Cybercriminals are widening the reach of information-stealing malware by targeting the local data created by AI coding agents. The shift puts access tokens, saved connections, prompt histories, and project records at risk on already infected computers. The activity does not point to a newly discovered flaw in Claude, Cursor, or Codex. Instead, it shows criminals adapting established stealers to collect valuable files stored in predictable local folders, a concern echoed in…
Excerpt shown under the publisher's RSS terms · 71 words · full text and figures are on the publisher's site
Related coverage

[AINews] not much happened today
Latent Space · Oct 3, 2026

New Aoki Malware Targets ChatGPT, Claude, Codex and Gemini to Steal Credentials
Cybersecurity News · Oct 16, 2026
Links #3: 2026/06 Part 1
LessWrong · Jun 15, 2026

[AINews] Meta Muse Wonder & Wonder Full: MSL’s Claude 5.5-tier Frontier Model
Latent Space · Oct 13, 2026