Eight Commodity Infostealer Families Add AI Coding Agents to Their Collection Lists

Locally stored data belonging to Claude, Cursor, Codex, Cline, Continue, OpenCode, Gemini, and Kilo on infected developer machines

Gen Digital published research on September 8, 2026 showing that eight commodity infostealer families have extended their collection logic to AI coding agents. The targeted material is not configuration in any meaningful sense: access and refresh tokens, Model Context Protocol configurations containing API keys, conversation databases, prompt histories, project traces, and file histories. Family by family, Amatera focused on Cline and Continue, Remus on Claude, Cursor, and OpenCode, and CallbackBeaver on Cursor and Claude with more than 5,000 samples observed in 30 days; BeeStealer, STG Stealer, HydraStealer, APEX Stealer, and Otter Stealer show the same behavior, and the macOS-focused Djinn Stealer covers Claude, Codex, Gemini, Cline, OpenCode, and Kilo. Tens of thousands of users were affected by Amatera and Remus alone. The surrounding telemetry puts this in proportion: infostealer detections in the first half of 2026 reached more than 3.3 million unique protected users, with monthly detections consistently above 500,000. The structural point Gen Digital makes is that adding an agent to a stealer's target list is a configuration update rather than a rebuild, so the cost of covering a new agent is near zero. As the report puts it, "once an AI agent holds credentials, conversation history, and a map of the user's work, its local files are no longer merely configuration"

Agents accumulate exactly the material a stealer wants, in predictable filesystem locations, unencrypted, on a machine the operator assumes is trusted. Nothing here is an agent vulnerability; the agent is a filing cabinet with the provider keys, the tool inventory, and a transcript of the work in one place