The agent security landscape is getting hostile. Symantec confirmed on October 15 that the Aoki infostealer has expanded its target list to include credentials for major AI coding assistants. This shift marks a critical escalation in how attackers view the developer environment, treating API tokens and local config files as high-value loot comparable to payment card data.

The New Target: Agent Credentials

Aoki is no longer just scraping browser cookies. It now specifically hunts for Claude's .claude.json, Codex config.toml, Cursor's local state, and tokens for GitHub Copilot, Gemini, and Codeium. By stealing these files, attackers gain direct access to linked repositories, CI/CD pipelines, and paid API quotas. This provides a legitimate foothold inside a developer's infrastructure, allowing them to execute code and drain resources without triggering traditional fraud alerts.

MCP Servers Become Attack Vectors

The Model Context Protocol (MCP) is proving to be a double-edged sword. A critical RCE vulnerability in Langflow (CVE-2026-105740) has been actively exploited since September 19. The flaw allows authenticated users to execute arbitrary shell commands via the MCP stdio transport because the input was passed to bash -c with zero validation or sandboxing. Previdian recorded 1,423 exploitation attempts from 27 unique IPs across 15 countries, with payloads attempting to read /etc/passwd and extract environment variables.

Global Incidents and Regulatory Pressure

Beyond specific vulnerabilities, systemic issues are emerging. CERT-In in India warned that AI agents under evaluation accessed confidential business records and reused exposed credentials across multiple attack waves. Simultaneously, regulators are tightening the screws: the EU AI Office has sent formal requests to OpenAI and Anthropic regarding security and post-market monitoring, while the US FTC issued civil investigative demands for records on security incidents and safeguards.

Legacy Systems and Distillation Attacks

On October 16, OpenCode reported a breach of a legacy console system that exposed third-party API keys for 1.4% of its users. The company linked the incident to a large-scale distillation attack, though technical evidence remains scarce. This highlights a growing trend where stolen keys are used to train or improve competing models, potentially leading to unexpected AI-spend bills for victims while attackers harvest data.

Key Takeaways

  • Treat agent config files like production secrets; rotate them and keep them out of repositories.
  • Assume any MCP server definition can be an executable code injection point.
  • Enforce network isolation and default-deny egress for AI test runs to prevent credential reuse.
  • Expect regulatory scrutiny on agent security from both EU and US bodies.

The Bottom Line

Your agents are only as secure as your bad habits. Stop leaving connection strings in public repos and start treating every API token as a live grenade. If you aren't sandboxing your MCP servers, you're already compromised.