A developer cleaning up an infected computer has more to check than saved passwords. In an October 30 report, SpyCloud describes recovered malware logs containing the digital keys used by local AI coding tools. Its advice is to include those tools in the investigation, rotate exposed credentials and revoke active sessions.
The security firm examined logs from WardenStealer and Aoki, two families of infostealers: malware that collects data from an infected machine and sends it away. The useful finding is the specific inventory. An account password, a token granting access and a file describing the developer’s environment are different things. A response that checks only one category can overlook material the report says these stealers collect.
In the WardenStealer logs it analyzed, SpyCloud found Claude Code’s OAuth credentials file. This file held access and refresh tokens used to obtain or maintain delegated account access. It also held tokens for connected Model Context Protocol (MCP) servers, through which AI tools connect to other services. These are distinct credentials inside the file, and the connected-service tokens belong in the inventory alongside the main account’s tokens.
SpyCloud’s WardenStealer inventory also includes:
- Codex authentication material: an OpenAI API key plus access and refresh tokens. The key is a credential for requests to the service, not the account password.
- Claude Code configuration: user and machine identifiers, plus the CLAUDE.md file that supplies standing instructions.
- Claude Desktop data: configuration and plan-usage history.
Aoki arranged AI-tool material in a separate AISessions folder, SpyCloud says. Its tool-specific subfolders covered ChatGPT, Claude Code, the Microsoft Store build of Claude Desktop, Codex, GitHub Copilot and Cursor. The reported contents included credentials, configuration, Copilot and Cursor token files, and cookies for web-backed tools. These are observations from the logs SpyCloud analyzed, not a claim that every infection exposed every item.
Configuration needs a separate place on that list. SpyCloud says instruction files such as CLAUDE.md and MCP configuration can describe the environment a stolen token reaches into. They are context, not credentials themselves. Their presence in a log should not be mistaken for evidence that an attacker successfully used them to control another system.
SpyCloud says it has ingested more than 130,000 unique WardenStealer infections since first observing the family in its collection on August 3, 2026. This figure is not a count of compromised AI accounts, and it does not establish how common AI-tool credential theft is across all developers.
Forkast’s earlier Microsoft 365 token-replay coverage explained why a password change need not remove every route back into an account. Its AgentBaiting reporting covered how fake skills distribute malware. SpyCloud’s report focuses instead on what local AI-tool material appears in stolen data after a machine is infected. It does not establish a connection to either prior campaign.
SpyCloud recommends: “Treat AI-tool credentials as in scope for the investigation.” Its response list is concrete: rotate exposed keys and tokens, revoke active sessions, and watch for anomalous API use. The task is to account for each kind of access the infected machine held, rather than treating a changed password as the complete cleanup.