AI token theft emerges as a growing security threat for users

AI users are increasingly falling victim to token theft, where attackers bypass passwords and 2FA by stealing active session keys and OAuth tokens. Incidents involving platforms like Anthropic's Claude have been linked to infostealer malware and malicious npm packages. Because tokens are stateless and often provide long-term access, attackers can hijack accounts to perform unauthorized tasks or sell access on the black market, making it difficult for users and providers to track and mitigate the losses.