Your AI subscription is now a credential, not a tool.
The lock held. The attacker never knocked.
On September 9, The Hacker News reported that infostealer logs are handing criminals replayable AI session tokens and API keys that open tools from providers like Google and Anthropic.
Stealers such as Lumma and Vidar quietly lift credentials, session tokens, and API keys off infected machines, and those logs get bundled and sold.
Meanwhile the patch queue is drowning, with Microsoft shipping a record 974 fixes in a single round this month. Volume alone is no longer a defense, which is why AI agents are already outrunning identity security.
A session token already carries proof that you passed authentication, so anyone holding it walks past your login screen without ever triggering a prompt.
The good news is that this is fixable, and it needs no new tools.
1. Revoke the keys you cannot explain.
Open every AI provider console and retire any token or key you cannot tie to a person, a purpose, or a date. Replace the survivors with scoped tokens that expire on their own rather than living forever.
2. Watch usage, not logins.
Stolen tokens rarely look like a break in, they look like Tuesday, just louder. Alert on spend spikes, odd hours, and model calls from regions your team has never worked from, and fold dark web threat intelligence into that picture.
3. Shrink what a stolen token can reach.
Bind tokens to a device or a network wherever the provider allows it, and keep AI keys out of browsers and notebooks, since that is where stealers look first. Sharpening your API security skills covers most of this, and authentication and authorization fundamentals explain why a token beats a password prompt.
Old playbooks guarded the front door and trusted everything that walked through it.
The new reality is that the key is already loose, so the only question worth asking is how little it can open.
Where do you draw the line between convenience and control with your AI keys? One shared key for the whole team, or one per person with a short leash? Tell me in the comments.