Five Minutes on AI Agents in Security: Intruders Use AI Tools, and Malware Steals AI Logins

This week, Elastic reports intruders running commands through Claude Code and the ChatGPT desktop app, and SpyCloud reports malware that steals the logins for AI tools. Check Point Research describes criminal campaigns that it says ran mostly without human input. NIST listed as final a workshop report on incident response for autonomous systems, and the UK government updated a factsheet on agentic AI incidents.

Intruders worked through trusted AI tools

Elastic reports that in confirmed intrusions between April and September 2026, intruders ran commands through Claude Code and the ChatGPT desktop app.¹ Elastic also reports that attackers logged in with stolen credentials an average of eight minutes after infection, and that in some cases they ran commands through these AI tools.² These are Elastic's findings.

What it means for security leaders: Are commands that come through an approved AI tool watched as closely as commands from anywhere else? Could anyone on your team tell an intruder's use from an employee's?

Infostealers now take AI tool logins

An infostealer is malware that copies saved logins and other secrets from an infected computer. A token is a digital pass that keeps you signed in without typing your password again. An API key is a secret code that lets software use a service.

SpyCloud researchers report two Windows infostealers, WardenStealer and Aoki, taking AI tool tokens. Cyber Security News notes that this is theft from user devices, not a breach of the AI providers.³ SpyCloud reports that the two malware families collect login tokens, API keys, and configuration files for AI coding tools. It reports more than 130,000 WardenStealer infections ingested, and it says such tokens can keep working after a password reset.⁴ These are the researchers' own findings.

What it means for security leaders: If a password reset does not end an AI tool session, a stolen token may still work after you have dealt with an infected laptop. Find out whether your response to an infected device also covers AI tool sessions and keys.

Criminal campaigns that mostly ran themselves

In its report on ARTEX, Check Point Research describes three criminal campaigns that it says ran mostly without human input once a goal was set.⁵ One campaign recovered more than 190,000 sets of gaming credentials, and about 3.3% of them still worked. Another obtained more than 300 Apple signing certificates, and three of them passed validation. A third, aimed at crypto payment sites, moved no money to the attackers.⁵ The report contradicts itself: it gives two different counts of exposed servers and two different dates for a change in the project's status. We leave those details out.⁵

What it means for security leaders: Our view, which is a working view and not a finding, is that these campaigns produced volume without much success. A report of a largely self-running campaign with high verified results would change our mind.

NIST and the UK on agent incidents

NIST IR 8621, a workshop report from the US National Institute of Standards and Technology listed as final on November 2, says fixed incident response steps have limits for systems that are probabilistic, autonomous, and deeply integrated.⁶ Among the needs it names:

• Telemetry from the layer where an AI system reasons. Telemetry is data recorded about what a system does.
• Governance of non-human identities, meaning the accounts and credentials that software uses instead of people.
• Containment limited to what a system is authorized to do.⁶

In the UK, the government updated its factsheet on agentic AI measures in the Cyber Security and Resilience Bill on November 3. It says the government will consult on measures to help regulated entities manage agentic loss of control incidents. It also describes post-incident review powers that would let Ministers task technical experts within government to review such incidents.⁷

What it means for security leaders: NIST's report treats the identities that software uses as something to govern, and it ties containment to what a system is authorized to do. The UK factsheet covers a planned consultation and post-incident reviews. Your incident playbooks may not yet say what to do when the actor is an agent.

The strongest case for calm

The strongest view against concern is one we share. Elastic, SpyCloud, and Check Point each report findings from their own investigations and data. In our reading, these findings show specific cases, not how common such attacks are. Check Point's results were small, and its report contradicts itself in places. We report these as cases to plan around, not as a trend.

A question for this week

If an attacker were using one of your approved AI tools with a stolen login today, what would tell you?

We report on security; we never publish exploit code, attack steps, or details of a weakness that is not yet fixed. Found a weakness? Report it to its maker first; please don't send us its details. Nothing here is legal, financial, investment, or security advice for your own systems; check with your own security team.