AI Accounts Are Becoming the New Target for Infostealers

An analysis of stealer log data from the last ninety days revealed that 482 companies had exposed AI accounts and credentials. Of these, 295 appeared in active logs, suggesting recent exposure. These exposures are linked to 5,434 stealer log records across 1,500 distinct corporate email addresses. A significant portion of these records relates to ChatGPT or OpenAI sessions, with 358 captured sessions identified across the exposed companies, representing approximately 90% of all recorded events. Other platforms like Zapier, Notion, Hugging Face, Replit, Lovable, and ElevenLabs were less represented in the data.
The presence of stolen AI logins points less to a security failure within OpenAI itself and more toward employee behavior—specifically, employees using work email for personal sign-ups on personal devices outside company policy. The absence of data concerning Claude and Gemini is noted, with context provided regarding how infostealer malware targets sessions versus simple password theft. A stolen AI session grants access to conversation history, which can contain sensitive proprietary information like source code or customer data shared during prompting. Furthermore, the existence of API keys for these services creates a financial vector through activities like LLMjacking, where stolen keys are used for unauthorized workloads or resold on underground forums.
Automation platforms amplify the risk; stolen sessions in tools like Zapier allow attackers to exfiltrate data across connected systems without further credential theft. The exposure is concentrated among technology firms and agents/automation exposures are most acute in sectors that handle client data, such as healthcare and finance. Recommendations focus on session management—implementing single sign-on, using short-lived sessions, rotating refresh tokens, limiting API key exposure, flagging unusual activity, and treating any employee appearing in a stealer log as an endpoint incident requiring immediate response.

* 482 companies were found with exposed AI accounts and credentials based on stealer log data from the last 90 days.
* 295 of these exposures appeared in active logs during the study period.
* These incidents are linked to 5,434 stealer log records across 1,500 distinct corporate email addresses.
* 358 captured ChatGPT or OpenAI sessions were found among the 482 companies, accounting for roughly 90% of all records in the study.
* Other platforms identified include Zapier, Notion, Hugging Face, Replit, Lovable, and ElevenLabs.
* A stolen AI login involves a live session cookie that allows an intruder to bypass credential-based authentication.
* Stolen AI account history can contain source code, customer data, contracts, or unreleased plans pasted into prompts.
* Underground forums were offering Claude API keys, ChatGPT cookies, and Cursor sessions for sale, sometimes with money-back guarantees.
* Automation platforms, such as Zapier sessions, can provide standing authorization to exfiltrate data across CRM systems and file storage.
* Technology firms account for the largest group of exposed entities (144 companies and 40% of records).
* Exposure regarding agent and automation occurs most heavily in healthcare, financial services, and technology sectors.

The narrative surrounding stolen AI sessions shifts the focus from traditional credential theft to session hijacking, which fundamentally changes the risk profile. The core implication is that security controls must evolve beyond simple password rotation to manage ephemeral session tokens and API keys—artifacts that represent live access rather than static credentials. This distinction elevates the threat because a compromised session grants immediate access to contextual, high-value corporate memory, effectively bypassing perimeter defenses once initial access is achieved.
The juxtaposition of user behavior (using personal devices) against systemic exposure creates tension regarding where accountability lies. While the data points toward employee error in setup, the existence of readily available exploit methods and secondary markets for AI tokens suggests that system design itself, particularly around session management and API key distribution, is contributing to the vulnerability. The concern over Claude and Gemini specifically—their relative silence in the data—highlights how emerging threats can be detected through absence as much as presence; this absence signals a rapidly evolving attack surface being actively managed or circumvented by security teams.
The economic dimension introduced by LLMjacking further complicates the risk calculation. When API keys are commoditized, the cost of protection shifts from mitigating direct system breaches to managing licensing and compute costs that an attacker can directly monetize. This moves the defense strategy toward treating AI access not just as a data breach remediation, but as an active asset management problem layered onto identity and endpoint security.
Bridge Questions: If session tokens are treated as highly sensitive keys, what organizational policies should exist regarding the lifecycle and revocation of these session entitlements across third-party AI services? How can organizations balance the need for robust operational context (session history) against the principle of least privilege when granting access to sophisticated automation agents? What mechanisms are necessary to detect shadow AI accounts that do not conform to established identity management practices?