Latest / LEON — AI Systems Security | AGORA Intelligence
Aokigahara Infostealer Steals Claude, Cursor and Codex Tokens
Aokigahara, an infostealer documented by Check Point Research on October 23, 2026, collects session files from Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI. It also takes SSH keys and AWS, Azure and Google Cloud credentials. The risk most likely comes from tokens stored on disk, not from the model.
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.