AI Accounts Emerge as Prime Targets for Infostealer Attacks
Corporate AI sessions and API keys are being hijacked, exposing sensitive data and compute resources.
1ChatGPT dominates exposure
SOCRadar's analysis of 482 compromised companies revealed 5,434 stealer log records linked to 1,500 corporate emails. ChatGPT sessions accounted for 90% of all exposed AI accounts (358 companies), dwarfing other platforms like Zapier and Hugging Face. The prevalence reflects widespread unauthorized ChatGPT usage via work emails on personal devices, often bypassing IT oversight. This shadow AI phenomenon creates security blind spots, as employees paste sensitive data into prompts without considering data exfiltration risks.
2Live sessions vs password resets
Stolen AI logins differ fundamentally from credential theft due to persistent session tokens. As Okta's research demonstrates, rotating passwords doesn't terminate active sessions - attackers remain logged in. SOCRadar found thousands of replayable tokens in a single 7GB stealer dump, including valid API keys for major AI providers. Session cookies effectively become corporate memory access points, exposing prompt histories containing source code, contracts, and unreleased plans without requiring internal system breaches.
3Financial risks of API key theft
Underground markets actively trade compromised AI credentials, with July-September 2026 seeing Claude API keys and ChatGPT Pro sessions sold with money-back guarantees. This enables LLMjacking - attackers run AI workloads at victims' expense or resell access. Stolen keys from notes apps or config files get monetized, while automation platforms like Zapier extend the attack surface. Financial exposure compounds data risks, as organizations foot compute bills for malicious actors' activities.
4Sector-specific vulnerabilities
Technology firms represent 40% of exposed records (144 companies), creating downstream risks for client data. Healthcare, finance, and tech face particular danger from automation exposures that enable lateral movement. The Anthropic August incident demonstrated concrete impacts - attackers drained paid Claude usage, forcing company-wide sign-outs and fraud refunds. As Reddit users reported, compromised sessions showed usage limits "refilled and then drained" overnight, highlighting real-time abuse patterns.
5Detection gaps in shadow AI
The absence of Claude/Gemini sessions in logs reflects adoption rates rather than security - attackers target platforms once they reach critical mass in corporate environments. Current monitoring fails to detect unauthorized AI usage, as employees bypass policies using personal devices. SOCRadar emphasizes treating stealer log appearances as endpoint security incidents rather than simple password reset cases, requiring credential rotation for unknown accounts.
6Automation amplifies risks
Compromised Zapier sessions provide standing access to CRMs, email, and file storage without additional credential theft. Attackers can build automated workflows to exfiltrate data from trusted IP addresses. This creates persistent threats that bypass traditional authentication controls, as demonstrated by Okta's findings of valid tokens in Telegram stealer dumps. The healthcare and finance sectors face disproportionate risks from these automation-enabled breaches.
7Effective response framework
Anthropic's August response provides a model: invalidating sessions, removing abused payment methods, and notifying users of device compromises. The report recommends short-lived sessions, token rotation, and SSO integration for AI platforms. Unusual location alerts and working hour restrictions can flag suspicious activity. Crucially, organizations must first discover shadow AI accounts - you can't secure what you don't know exists, making proactive detection the foundation of defense.
8Prioritizing immediate risks
While AI safety debates focus on futuristic scenarios like autonomous agent swarms, infostealer attacks represent clear and present dangers. A single employee's unmanaged laptop with saved ChatGPT credentials can compromise corporate memory through readily available malware. The report shifts focus from theoretical risks to actionable controls, emphasizing that basic session hygiene and shadow IT discovery can prevent most real-world breaches occurring today.
Original article: Security Affairs — AI Accounts Emerge as Prime Targets for Infostealer Attacks