PERMISSION/PROTOCOL
Back to incident tracker

2026-09-08

HighPrimary

Commodity Infostealers Added Claude, Codex, Cursor, and MCP Data to Their Collection Rules

Gen Digital found active infostealer families collecting AI coding-agent tokens, MCP configuration, prompt histories, and project data from compromised developer endpoints.

AI coding agents and MCP clientsCredential exposureInformation-stealer collection of locally stored AI-agent credentials, configuration, and work historyDeveloper endpoints running locally installed coding agents or MCP-connected tools after an infostealer has already gained user-level access

What happened

Attacker-operated information stealers added AI-agent directories and files to remotely managed collection rules, allowing malware on compromised Windows and macOS endpoints to harvest agent authentication material, MCP configuration, conversations, and project context.

Why it matters

Potential AI-account takeover, unauthorized consumption of paid service capacity, access to MCP-connected source control or cloud services, and exposure of proprietary code, internal infrastructure details, or trade secrets. Gen Digital did not publish a count of confirmed successful compromises caused by the AI-agent collection rules.

Missing authorization check

Downstream services accepted locally stored bearer credentials as sufficient authority, without requiring an independently authenticated, action-specific decision before consequential credential use.

Would PP block it?

PP can reduce downstream blast radius only where protected operations such as merging, deploying, publishing, exporting data, or mutating infrastructure use an external enforcement point and signing authority. That conditional defense does not block the reported credential collection itself.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-09-08

    Gen Digital publishes its analysis of information-stealer collection rules targeting locally stored AI-agent data.

  2. 2026-09-08

    Gen reports Amatera and Remus detections among tens of thousands of protected users over the preceding three months and more than 5,000 CallbackBeaver samples in a recent 30-day period, while cautioning that detections do not establish successful infection.

  3. 2026-09-09

    Independent security-news coverage reviews the finding and preserves the distinction between detections and confirmed successful infections.

Technical breakdown

  • On Windows, Gen observed Amatera targeting Cline and Continue data and Remus targeting Claude, Cursor, and OpenCode artifacts.
  • CallbackBeaver added Cursor and Claude to its collection scope; Gen observed more than 5,000 samples during a recent 30-day period.
  • On macOS, Djinn Stealer was associated with collection from Claude, Codex, Gemini, Cline, OpenCode, and Kilo.
  • The targeted material can include access and refresh tokens, account data, MCP endpoints and reusable secrets, prompt histories, conversation databases, and project metadata.
  • Because many stealers receive remotely managed collection rules, operators can add a newly popular agent by updating target paths or filenames without necessarily rebuilding the malware.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Credential Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Credential-backed API, deployment, publication, data-export, and protected mutation boundaries outside the compromised endpoint
Still needs
Endpoint protection, secure local credential storage, short-lived token design, malware removal, session revocation, credential rotation, and assessment of exposed prompt history remain necessary.
Receipt required for
Using agent or MCP credentials to merge, deploy, publish, export sensitive data, or mutate protected infrastructure

This is attacker-operated malware on an already compromised endpoint, not a governed agent exceeding delegated authority. Permission Protocol cannot prevent the infection or the theft of local agent and MCP data.

Start small

Put the relevant gate at this action boundary.

This incident maps to Credential Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop