dev.to· Oct 17, 2026· by gabrielanhaia

An Infostealer Now Grabs .claude.json and Codex's config.toml. Check What Yours Hold

Open Original Article ↗
Symantec says Aoki now steals Claude, Codex, Cursor and Copilot credentials. Find the tokens your agent configs hold in plain text, and what to rotate.
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.
#ai#security#claude#codex