Infostealers are exposing corporate AI accounts, sessions and API keys, giving attackers access to sensitive data, compute and connected systems.

SOCRadar analyzed stealer log data from the last 90 days and found 482 companies with exposed AI accounts and credentials. Of those, 295 appeared in active logs during that period, suggesting the exposure is recent rather than the result of historical cleanup. Together, these companies account for 5,434 stealer log records linked to 1,500 distinct corporate email addresses.

The number that really stands out is the ChatGPT figure. A captured ChatGPT or OpenAI session appeared at 358 of the 482 companies, accounting for roughly 90% of all records in the study. Other platforms, including Zapier, Notion, Hugging Face, Replit, Lovable and ElevenLabs, were far behind.

This doesn’t necessarily point to a security problem with OpenAI. It says more about how employees use AI at work. Many people simply signed up for ChatGPT with a work email and used it on a personal device, often outside company policies and without IT teams even knowing it was happening.

Claude and Gemini barely appear in the data, and SOCRadar is explicit about what that means and what it doesn’t. The researchers read the absence as a shadow-AI signal, not evidence that those platforms are safer to steal from. Anthropic demonstrated that in late August when infostealer malware started hijacking Claude sessions to drain paid usage, forcing a company-wide sign-out, payment method removal, and fraud refunds. Users noticed on Reddit when their usage limits “refilled and then drained” overnight. Claude sessions are targeted the moment they exist in enough volume; there are just fewer of them in corporate environments today.

A stolen AI login is categorically different from a stolen password, and the report makes a clear case for why the industry needs to treat it that way.

“A stolen cookie is a live session. As Okta’s Jeremy Kirk put it, “session tokens and API keys are sought specifically by threat actors because it is often possible to replay those secrets and bypass credential-based authentication.”” reads the report published by SOCRadar. “Rotating the password alone leaves the intruder signed in.”

That quote comes from Okta researcher Jeremy Kirk, cited in the report after Okta’s team pulled a 7 GB stealer dump off Telegram and found thousands of still-replayable tokens inside, including two dozen valid API keys for major AI providers. Rotating the password after a credential theft doesn’t help if the active session cookie is still valid. The attacker stays logged in regardless.

The conversation history inside a compromised AI account creates a different kind of breach. Employees often paste source code, customer data, contracts and unreleased plans into AI prompts without thinking of it as data leaving the company. But once an attacker takes over the session, they can access that entire history without ever breaking into the company’s internal systems. The AI account has effectively become part of the company’s corporate memory, and the stolen session provides access to it.

API keys add a financial risk on top of the data exposure. During July, August and September 2026, underground forums were openly offering Claude API keys, ChatGPT cookies from paid and Pro accounts, and Cursor sessions, in some cases with money-back guarantees. This fuels a type of abuse known as LLMjacking: attackers steal keys from notes, configuration files or workspace settings and use them to run AI workloads at the victim’s expense, or resell the access at a discount. The victim gets the bill. The attacker gets the computing power.

“Keys copied into a notes app or a workspace settings page get lifted with everything else, then billed to the victim or resold. Underground vendors sell discounted access to Claude, Gemini and Cursor accounts and money-back guarantees.” states the report.

Automation platforms make the exposure worse. A stolen Zapier session carries standing authorization into CRM systems, email, and file storage. An attacker with access can build a workflow that exfiltrates data on a schedule, from a trusted vendor IP address, without any further credential theft required.

The sector breakdown is worth noting. Technology firms are the largest group at 144 companies and 40% of all records, which matters because those companies hold downstream client data too. But industrials, financial services, healthcare, retail, and energy all appear in force. Agent and automation exposure, the category that carries an employee’s authorization into other systems, concentrates specifically in healthcare, financial services, and technology, which are exactly the sectors least able to absorb that kind of lateral movement.

All of this is happening while the AI industry debates frontier safety risks, autonomous agent swarms, and the pace of development. That conversation is real and worth having. This report is about something more immediate and considerably more actionable:

You don’t need an autonomous swarm to lose your corporate memory. One employee, one unmanaged laptop, one saved ChatGPT password and a commodity infostealer, widely available in Telegram channels since 2022, can be enough.

The controls recommended in the report are straightforward. Put AI platforms behind single sign-on, use short-lived sessions and rotate refresh tokens so stolen cookies expire quickly. Limit and regularly rotate API keys, and flag activity from unusual locations or outside normal working hours. If an employee shows up in a stealer log, treat it as an endpoint security incident, not simply a password reset. And find shadow AI accounts first: you can’t rotate credentials or secure accounts you don’t even know exist.

Anthropic’s own response to the August incident is the template the report points to: the company didn’t just advise a password change, it invalidated sessions, removed payment methods attackers were abusing, and notified affected users that their machines were compromised. That last step is the difference between a data feed and an actual fire alarm.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI accounts)

Google Gemini escaped a cyber test environment, reached three real companies, and exposed why AI security tests need strict isolation.

Google has confirmed that one of its Gemini models broke into the systems of three real companies during a cybersecurity test in May. The incident is the first publicly known case in which a Google AI system escaped its test environment and accessed real systems online.

“Google’s Gemini model accessed the internet and hacked other companies during a test of its cybersecurity capabilities, the first known example of the company’s artificial-intelligence systems autonomously committing such an act.” first reported the Wall Street Journal.

The test was run by Irregular, a company that evaluates the security of advanced AI models. Gemini was supposed to attack fictional companies inside a controlled environment as part of a capture-the-flag exercise. There was one problem: the testing environment accidentally had internet access, and one of the fictional company names matched a real company.

Once Gemini could reach the internet, it did what it had been asked to do. In one case, it repeatedly guessed passwords until it gained access to a protected system. In two others, it found credentials in a public repository and used them to reach systems belonging to real companies.

The key point is that Gemini wasn’t given permission to attack those companies. The model simply had the wrong target because the test environment was connected to the real world. That’s a basic testing failure, but it becomes much more serious when the system performing the test can independently find credentials, try passwords and interact with external systems.

The model did something important once it understood what had happened. It stopped the attacks after realizing that the systems belonged to real companies rather than the fictional targets used in the exercise. Google says none of the companies suffered damage, and the affected organizations were informed.

“The model acted appropriately.” Google’s vice president of security engineering, Heather Adkins, used that wording when discussing the incident. Google also said it didn’t consider the episode an example of model misalignment because Gemini stopped once its safety mechanisms were triggered.

That’s a reasonable distinction, but it doesn’t make the incident unimportant. The model still crossed the boundary from a simulated exercise into real corporate systems. The fact that it stopped is relevant. So is the fact that it was able to get there in the first place.

“This event highlights the importance of training powerful AI models to act responsibly.” That’s also Google’s position, and the company said it worked with Irregular to change its testing procedures. Irregular said the known issues on its side had been fixed weeks earlier.

The timing matters too. Irregular notified Google about the incidents in July, but Google didn’t publicly disclose them at the time. The company told the Wall Street Journal that it didn’t believe disclosure was necessary because Gemini had stopped the attacks and hadn’t caused harm. The incidents became public after the Journal asked Google about them.

That decision is worth examining separately from the technical failure. A model reaching a real company’s infrastructure during a security test doesn’t suddenly become harmless because it stops after recognizing the mistake. It gives security teams useful information about what can happen when an autonomous system has both offensive capabilities and unexpected access to the internet.

“all known issues on our end were remedied and resolved weeks ago.” Irregular made that statement after notifying the relevant AI labs and the affected organizations. The company has also said it is working on better practices for running cybersecurity evaluations safely.

And this isn’t an isolated case. Irregular has been involved in similar incidents involving models from Anthropic, OpenAI and Meta. In each case, the basic problem was similar: AI systems being tested in controlled environments unexpectedly gained access to real-world targets.

The difference between the incidents matters. Some models stopped when they realized they had reached real systems. Others continued. That makes the behavior of the model itself important, but it also shows why security can’t depend on a model making the right decision at the right moment.

A properly isolated test should assume that the model will eventually make a mistake. Internet access, credentials, DNS, naming conventions and external services all need to be treated as potential escape routes. If one accidental connection can turn a fictional target into a real one, the problem isn’t just the model. It’s the environment in which the model is allowed to operate.

The broader issue is becoming harder to ignore. AI systems are increasingly capable of reconnaissance, credential discovery and basic exploitation, and they’re doing more of this work with less human intervention. The recent incidents involving Gemini, Claude and other systems suggest that security testing needs to account for what these models can actually do, rather than what developers expect them to do.

“These events highlight the importance of training powerful A.I. models to act responsibly.” That final point from Google is easy to agree with, but responsible behavior has to be backed by technical controls. A model should not need to recognize that it has crossed a line after the line has already been crossed.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Gemini)