Aoki Steals Model API Keys From Dev Laptops — Rotate Now

Last Updated: October 17, 2026

Infostealers have targeted browser cookies, crypto wallets and password managers for a decade. What changed this month is the target list. Symantec's Threat Hunter Team reports that recent Aoki samples go after .claude.json, Claude desktop cookies, ChatGPT cookies, and Codex config.toml and .env files, plus tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, alongside AWS credentials. Older samples of the same family did not look for AI-related files at all, which tells you the capability was bolted on recently and deliberately.

If you only build chat interfaces, this is a developer hygiene story. If you run agents in production, it is an identity story, and the blast radius is larger than most teams have mapped.

What Aoki actually steals

The useful detail in the Symantec write-up is what the malware does not take. It collects credential, token and session files rather than source code, with one exception: Cursor's local state database, which can cache chat context and code snippets. That exception matters more than it sounds. Agent chat history is where engineers paste connection strings, sample payloads with real customer records, and the exact shape of internal APIs.

Operationally, Aoki is unsophisticated and that is the point. It has no backdoor command list — it grabs whatever is available and posts it to a /gate endpoint on its command-and-control server. No interactive operator decides what is interesting on your machine; everything in the target list leaves in one shot, including password manager artefacts, FileZilla and WinSCP sessions, VPN configs and Telegram sessions. Symantec published seventeen file hashes and three C&C domains, enough for a retro-hunt but not enough to call a host clean if you find nothing.

Treat the target list as the scope of compromise. If a developer machine is confirmed infected, every credential class on that list is burned, not just the ones you can see being used.

The blast radius is your production fleet, not one laptop

Here is the pattern in almost every mid-size AI build, and it is sequencing rather than sloppiness. Someone creates an API key during the prototype. It goes into a dotfile so the coding assistant works, then into the workflow platform's credential store so the first automation works, then into a CI secret so the eval suite runs. Six months later there are fourteen agents across three environments on one key, because nobody wanted to break a working pipeline in order to split it.

So a single infected workstation hands an attacker three things simultaneously: unmetered inference on your account, the identity your provider-side logs will attribute the activity to, and — via tokens for GitHub, AWS and whatever your MCP servers authenticate with — tool-call reach into the systems those agents touch. Symantec makes the same point: stolen keys let activity run under a legitimate developer's identity and quota, and can expose connected repositories, cloud services and CI/CD pipelines.

The economics have been proven out for two years. Sysdig coined the term LLMjacking in May 2024 after watching stolen cloud credentials used against hosted model services; their worst-case model put the bill at over $46,000 per day for the victim, and the credential-checking script they recovered probed ten different AI services to work out which keys were live and what quota they carried. By June 2026 the team was documenting attackers using stolen and exposed model capacity as the reasoning engine inside an automated exploitation pipeline. Your key is not just compute to resell. It is someone else's agent runtime.

The timing makes this worse. On the same day the Aoki report landed, Microsoft announced Copilot Studio agent accounts and business process memory — agents that work in Microsoft 365 with their own credentials, can be triggered by an external signal with no human prompt, and carry context forward between runs. Microsoft has been building toward this since July 2026, when Copilot Studio began automatically creating a Microsoft Entra Agent ID for every new agent with no environment-level opt-out. Directionally this is correct — attributable agent identity beats agents borrowing a human's token. But it also means the count of long-lived, always-on identities holding production reach goes up sharply, in the same quarter that malware started shopping specifically for model credentials.

A 48-hour rotation sequence that doesn't break running agents

The naive response — revoke everything now — is correct for a confirmed infection and wrong as a precautionary posture, because it kills in-flight agent runs, half-finished batch jobs and scheduled workflows that will retry blindly against a dead key until someone notices the error volume. Order matters.

The containment model: scoped keys, short-lived tokens, hard ceilings

Rotation is the incident. Scoping is the fix. The goal is that the next stolen credential is worth almost nothing: a key that can call one model family, inside one workspace, with a daily cap measured in tens of dollars, and no path to the tools your agents can reach.

Spend ceilings are the single highest-leverage control because they convert an unbounded loss into a known one. Anthropic's Console exposes spend limits through a beta Admin API endpoint with daily, weekly and monthly periods and scopes that include organization, workspace, individual user and RBAC group. Set them per workspace, not per organization: an org-level cap only tells you something went wrong after it has consumed the entire budget, while a per-agent workspace cap fails one workflow and leaves the rest of the business running. Check the equivalent controls in each provider console yourself rather than assuming parity — the feature sets differ, and they moved again this year. We keep a running view of provider behaviour on our model coverage page.

The deeper fix is not storing runtime keys in the workflow platform at all. Have the orchestrator request a short-lived credential at run start from a broker that knows which agent is calling, what it may call, and what it has already spent this period. That is more engineering than most teams expect, but it removes the fattest target in a typical automation stack: a credentials table in a self-hosted database on a VM someone set up in week two and has not patched since.

Detection signals that actually fire

Most teams monitor model spend monthly, in the billing console, which detects an incident roughly thirty days after it starts. The signals that fire in useful time are behavioural, and you need a baseline before the incident to use any of them.

Token-burn rate per key per hour. Agent workloads are boringly periodic: a nightly batch, a business-hours triage flow. Alert on a key exceeding roughly three times its trailing 7-day hourly maximum, not on a monthly dollar threshold. Stolen-key abuse shows up as a flat, sustained burn at odd hours.

Model mix. A workflow pinned to one model that suddenly calls three others is either a deploy you can point to or someone enumerating what your key can reach. Sysdig's recovered tooling did exactly this: enough calls to establish which services and quotas the credential carried, without running real queries.

Geography and network origin. Your agents run from a known set of egress addresses. Abuse frequently arrives from residential ranges — the offensive pipeline Sysdig captured in June 2026 ran from residential and small-business IPs across several sessions. If your provider surfaces request origin, alert on anything outside your egress set; if it does not, put the agents behind your own proxy so you control that telemetry.

Tool-call mix. This is the agent-specific one and the one almost nobody instruments. An agent with twelve MCP tools available normally uses three of them in a stable ratio. A run that suddenly exercises the CRM export tool, the file-read tool and the outbound email tool in sequence is worth paging on even if the token count looks normal. Log tool invocations as first-class events with the agent identity attached, separately from model usage.

Logging tampering. Sysdig observed attackers checking and disabling invocation logging before abuse. A sudden gap in your own model invocation logs is itself the alert.

What to tell a client whose key sat in a config for 18 months

You will not be able to say "you were not breached". Say the honest version instead, in this order.

First, scope: that key held whatever permissions it held for eighteen months across however many machines it reached, and provider logs rarely retain that far back, so absence of evidence is not evidence of absence. Second, exposure path: list every surface the key touched — laptops, CI, the workflow platform, contractor machines. That list is the actual finding, and it is usually longer than the client expects. Third, the financial bound: pull the full billing history and look for sustained off-hours usage, the one retrospective signal that survives. Fourth, the fix with dates attached, not a posture statement.

What you should not do is run a theatrical rotation and move on. If the architecture still puts one long-lived key in reach of a laptop, you have bought thirty days. The deliverable is the scoping change — per-agent credentials, spend ceilings, tool-permission boundaries — and it is worth scheduling as its own piece of work rather than as an afterthought on an integration project.

Where this advice stops

Three honest limits. Short-lived token issuance adds a hard dependency that can take your whole agent fleet down; if you cannot run the broker with better availability than the workflows it serves, keep long-lived keys and invest in ceilings and alerting first. Per-agent keys multiply inventory — a registry of forty keys nobody maintains is worse than four keys everyone understands, because expired-key failures look exactly like model outages at 3am. And persistent agent identities do not reduce credential count; they move it into a directory where it is at least governable, which helps only if someone reviews those identities on a schedule.

The thing to internalise from Aoki is narrower than the headlines: model-provider credentials are now a named, enumerated target in commodity malware, and they are being written into dotfiles by tools that millions of developers installed this year. The config format is public. The file paths are public. The only variable you control is what a stolen key can do. If you want a second pair of eyes on where your keys actually live, start here.