Nobody Needs Your AI Password. The Cookie Says You Already Logged In.

The dashboard had a search bar, a validation queue, and 23,800 stolen secrets in it

Google's threat analysts found an exposed server and, in its directory listing, files any developer would recognise on sight: AGENTS.md, KNOWLEDGE.md, a folder called memory. Shortly after they noticed it, the directory turned into a working production front end whose job was to organise, validate and manage more than 23,800 harvested secrets in real time, including API keys for cloud and AI services. Somebody had built a credential theft business with a proper user interface, and the agents were running it.

Two pieces of research published days apart describe the two halves of that business. Google Threat Intelligence Group covers the demand. Okta covers the supply. Read together they say something narrower than the usual claim that criminals are using AI. The scarce thing attackers now steal is permission to use a model, and the way they take it never touches your password, your second factor, or anything your login page will ever see.

What the two reports found

Okta's threat intelligence team took one 7 GB infostealer dump, posted to a Telegram channel on 2 August 2026, and counted what was inside. Infostealers are commodity malware that scrape a compromised laptop for anything reusable, and the criminals running them sell the harvest in bulk as logs. This one held data from 5,871 infected machines in 162 countries. Among it sat 44,791 unique JSON Web Tokens (JWTs, the signed strings a service hands your browser after you sign in so it stops asking who you are), 555 of them tied to AI services, plus 2,937 encrypted variants mostly set by OpenAI. On the day the dump went public, 1,843 of those tokens had not yet expired.

The mechanism deserves a slow read, because it walks past controls most organisations consider settled. A session token is not a credential you type. It is proof that somebody already typed one successfully. Replaying it skips the login entirely, which is why the password policy, the password manager and multi-factor authentication (the second step after the password) all sit unused while the attack happens. Jeremy Kirk, who directs threat intelligence at Okta, describes the result as being logged in without actually logging in. The behavioural safety nets fail too: attackers load the stolen browser storage into an anti-detect browser such as Camoufox, route it through a proxy near the victim, and the impossible-travel alert never fires because the geography looks right.

• A scan of the same dump with the secret-hunting tool TruffleHog found 24 API keys still valid for Google Gemini, OpenAI, Groq and OpenRouter.
• Google reports underground prices for AI accounts more than doubled during 2026, with demand concentrated on Claude and Gemini credentials and rising interest in coding tools such as Cursor Pro and Devin.
• In May 2026 the operators of ACRSTEALER told infected machines to grab two files by name: the secrets.json belonging to Cline and the config.yaml belonging to Continue AI. Both can hold API keys in plain text.

Why it matters

The concrete bill lands on whoever owns the account. Mandiant investigated an intrusion in April 2026 that began with a GitHub access token left exposed and ended with the attacker running an agent framework inside the victim's own cloud tenancy, creating a service account with editor rights, querying the company's data warehouse for further credentials, and filing a quota request for NVIDIA RTX 6000 hardware to keep the workload fed. The victim paid for all of it. Your own exposure is quieter and probably already present, because AI tools reached your staff faster than your device policy did. Every engineer signed into an assistant on a personal laptop is carrying a token that hands over your corporate account to anyone who steals the cookie, and every coding assistant that writes a key to a config file has put your model quota on disk in clear text. Ask your identity team this week whether a session replayed from an unfamiliar device would raise anything at all. For most companies the honest answer is that it would look like a normal Tuesday.

The systemic shift belongs in a planning meeting rather than a security bulletin. Google states plainly that the cost of premium model access and high-performance compute is one of the primary barriers for attackers trying to operationalise AI. That single sentence reframes the category. Skill stopped being the constraint some time ago and the constraint is now the invoice, which makes credential theft the supply chain for offensive AI. The loop then closes on itself. In one case from the second quarter of 2026, a financially motivated group used compromised cloud infrastructure, an AI coding assistant and a set of markdown instruction files to plan, build and run a mass credential harvesting campaign in under six hours, taking thousands of third-party credentials while the agent handled its own error recovery and rotated addresses without supervision. Stolen access buys the tooling that steals more access.

What to do about it

1. Shorten AI session lifetimes and bind them to the device. A stolen token is only worth anything while it lives, so short-lived OAuth tokens plus Chrome's Device Bound Session Credentials, which tie a session cryptographically to the machine that created it, turn a theft into a window of minutes instead of an open door.
2. Audit what your coding assistants have written to disk. Search developer machines for the config files these malware families now request by name, because a key sitting in plain text in a home directory is a copy of your model quota that no amount of login hardening protects.
3. Put AI platform access behind IP allowlisting and alert on session reuse from an unrecognised device. Allowlisting is the one control that reliably breaks replay, and device-change alerting catches the rest, because nothing else in your stack will notice a valid session doing valid things.

Bottom line

The uncomfortable part of both the Google report and the Okta analysis is how ordinary the theft is. No new vulnerability, no clever exploit, just commodity malware collecting cookies that were always going to be lying around, sold in bulk to buyers who want compute rather than data. Your organisation has spent three years asking what employees put into AI tools. These reports raise the opposite question, and it usually has no owner: who else is currently using the AI accounts you pay for, and how would you ever find out?