Symantec's Threat Hunter Team (Oct 15) says newer builds of the Aoki (Aokigahara) stealer, first seen earlier in 2026, added AI-tool targets that older samples lacked: .claude.json, Claude desktop and ChatGPT cookies, OpenAI Codex config.toml and .env, tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro, and AWS credentials, on top of the usual browser, wallet, password-manager, Discord, Telegram, VPN and FTP haul. Cursor's local state database is the one target that can hold chat context and code snippets. Aoki has no command set; it grabs what it finds and POSTs it to a /gate endpoint. Symantec notes these tokens let an attacker act as the developer against connected repos, cloud and CI/CD. No actor is named. The defense is to treat AI-tool sessions like any other credential: revoke and rotate from a clean device after an infection.