SC Media ran the Symantec note on October 16. New Aoki builds are going after credential and session files for AI coding assistants. Older Aoki, per Infosecurity Magazine in that brief, wanted browsers, crypto wallets, and password managers. It did not want AI files. This version does.
The list is specific. .claude.json. Claude desktop cookies. ChatGPT cookies. Codex config.toml and .env. Tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant, Kiro, and AWS credentials. Symantec’s line, as SC quoted it: AI credentials are now as valuable to thieves as payment cards and wallets, because they spend someone else’s quota and wear someone else’s identity.
That is a malware story about config files. It is not a model review.
Politico on October 15 said the Senate is expected to add Claude for staff. They already have Copilot, ChatGPT, and Gemini. JournalArta on October 14, via NPR, said ChatGPT’s Trusted Contact feature only works if you turned it on in Settings before a crisis. Three products. One week. The file on disk is the one that ships first.
We already filed plugin installs against SHA pins and Codex as a cloud desk. This week the assistant is a loot table.
The file list is the product
SC’s brief is short. The file names are the part to keep. .claude.json is a home-directory object. Codex config.toml and .env are the local secrets pattern every tutorial still teaches. Desktop cookies mean a logged-in app is enough. You do not have to paste a key into a phishing page if the stealer can read the profile.
Cursor, Copilot, Gemini, JetBrains AI Assistant, Kiro sit in the token column. AWS is in the same sentence. That last one is the tell. The campaign is not “people use chatbots.” The campaign is “the same box that talks to a model also talks to cloud.”
If your threat model was “don’t paste the key in Slack,” raise it. The key is already in a file the editor created for you. Aoki is written for that file.
Do not assume Linux is out because the names look like macOS and Windows app data. Treat any machine that runs the desktop assistant as in-scope until Symantec publishes the opposite.
Kiro is in the list. If you do not use Kiro, still read the list as “whatever assistant the developer installed.” The set will grow. The pattern is: local config plus session cookie plus cloud token.
Stolen quota is identity
SC’s wording: stolen tokens let someone work under a legitimate developer’s identity and API quota, and they can expose connected repositories, cloud services, and CI/CD. That is three losses, not one.
Quota is the bill. Identity is the commit. CI is the pipeline. A stolen Copilot or Cursor session is not a fun clone of your chat history. It is a way to open the repo the assistant already has permission to see.
AWS credentials next to Gemini tokens is how a laptop becomes an account takeover. If your assistant docs told you to put AWS_ACCESS_KEY_ID in .env because the agent needs S3, Aoki does not have to phish you. It reads the file.
Rotate on a schedule that assumes the laptop can be wrong. That is dull. It is also the mitigation that matches this malware family. Card data used to be the prize because it spent money. API tokens spend money and write code.
If your org bills usage to a shared key, one laptop burns the floor for everyone. Split keys. Per-user. Per-repo if you can. Do not keep the org-wide Claude key in the same home directory as Chrome.
The Senate seat is another login
Politico’s October 15 story is not about Aoki. It is about a fourth chatbot landing on the same desks. Two people familiar with the matter, not for attribution. Staff already have Microsoft Copilot, OpenAI ChatGPT, and Google Gemini. Sergeant at Arms Jennifer Hemingway said that in April testimony. She also said her office was running an AI working group. House CAO and Senate SAA have both issued internal guidance for official use.
The increment for this site is not Congress. It is the pattern: every new “approved tool” is another credential file. Claude on a Senate laptop will look like .claude.json on yours. Guidance documents do not rotate tokens.
If your company is about to “add Claude” because staff already have three other assistants, count the new profile directories before you send the announcement. Four apps is four cookie jars.
Hemingway’s April list is Copilot, ChatGPT, Gemini. October is Claude. That is a year of adding, not replacing. Aoki’s list matches the adders.
Do not read Politico as a security advisory. Read it as demand. The more offices that bless the same four apps, the more it is worth writing stealers for those four config paths.
Trusted Contact is a Settings toggle
JournalArta, Elena Vance, October 14: OpenAI’s Trusted Contact feature can alert someone you chose if the system sees a serious safety risk. Only if you set it up in Settings first. NPR reported the feature in August, in a story about a young woman who died by suicide in 2024 after using an older ChatGPT as a therapist. The newer NPR angle is whether people even know to turn it on before they need it.
This is not Aoki. It is the other half of “the tool is a product with a settings page.” Malware wants the json. Safety wants a toggle that is off by default.
If you are writing an internal AI acceptable-use page this week, put both. Rotate coding-assistant tokens. If you allow ChatGPT for personal use on a work browser, say whether Trusted Contact is expected. Do not mix the two into one sentence. One is credential hygiene. One is a crisis workflow.
The JournalArta piece is explicit that setup has to happen before the detection. After is too late. That is the same shape as a hardware key you did not buy yet.
NPR is the source to keep if you cite the feature. JournalArta is a recap dated October 14. Do not upgrade a recap into an OpenAI changelog.
What to pin, what to stop leaving on disk
Move secrets out of the assistant’s default files if the product lets you. If it does not, treat the home directory as production. Full-disk encryption on. Separate OS user for the machine that holds org keys, or do not hold org keys on that machine.
.env next to config.toml is convenience. It is also the path SC just printed. Use the OS keychain or a secrets manager. If the coding assistant cannot read the keychain yet, that is a reason to keep the agent away from prod credentials, not a reason to dump AWS into a text file.
Pin versions of the desktop apps. We already learned that with plugins that did not care about SHA pins. An auto-updating Electron shell is how a new steal path lands without a meeting.
Log out of desktop Claude and ChatGPT on shared boxes. Cookies are in the Symantec list. A shared lab machine with a still-open Codex session is a shared lab machine with a still-open bill.
Watch the Gemini paid rollouts as a reminder that a new model SKU is also a new login. Argon on Pro is a product. The token that fetches it is the object Aoki wants.
If you only do one thing after the SC brief, search the laptop for .claude.json, config.toml, and .env. If those files hold live keys, rotate the keys, then stop writing keys there. Symantec did not publish a pretty dashboard for this. They published file names. Use the file names.
Cursor in that token column is the same class as Copilot: an editor session that already has the repo. A stolen Cursor token is not a chat export. It is a way to keep working in the project after you closed the lid. If your team standardizes on Cursor, the Aoki path is the team standard.
Codex config.toml next to .env is the tutorial default. Move the secrets. Leave the toml as non-secret config. If the product cannot start without a key in that directory, file it as a product bug internally and use a wrapper that injects from the environment at launch.
JetBrains AI Assistant in the same token list is how a Java shop gets pulled into a campaign that looks like a Cursor story. If your developers never installed Claude Desktop, they still might have a JetBrains token on disk. Inventory by process list, not by who talked about Claude in standup.
House CAO guidance and Senate SAA guidance, in Politico, are the official-use documents. They tell staffers how to use the blessed tools. They do not hash the profile directory. If your company copies “we issued guidance” and calls it a control, you have a PDF. Aoki does not read PDFs.
Working groups are how a fourth tool gets added. Hemingway’s April working group plus an October Claude seat is the timeline. The stealer authors do not need the meeting minutes. They need the default path of the new app.
Financial value, in Symantec’s line, is the reason this family moved. Cards and wallets were direct cash. API quota is cash plus compute plus whatever the token can see. A stolen Codex session that can open a private GitHub org is not a $20 ChatGPT bill. It is source. Treat it like source.
Do not store “emergency” AWS keys in the same tree as the assistant because a blog told you agents need S3. If the agent needs an object store, give it a scoped role from a secrets manager and a short TTL. If it cannot do that yet, it does not belong on the laptop that also holds the org GitHub token.
Desktop cookies mean a “remember me” box is a credential. Log out of lab machines. Browser profiles used for ChatGPT are in the list next to Claude desktop cookies. A locked screen helps a thief who needs the keyboard. It does not help a stealer who reads the profile at rest unless the disk is encrypted and the box is off.
Aoki used to want wallets. It still might. The new work is the assistant. The model card is not the prize. The session is.