Disclosed vulnerability
AIKatz: harvesting authentication tokens from ChatGPT, Claude and Copilot desktop apps to hijack LLM sessions
AIR-2025-0164 AIR record · 2025-01-lumia-aikatz-desktop-token-theft
From the supporting source
The attack allows, through credential harvesting, for the attacker to access and manipulate a victim’s LLM conversations after infecting their machine (post-breach exploitation).lumia.security
The record
Disclosed
2025-11-01
Vendor
Anthropic, OpenAI, Microsoft
Product
Claude, ChatGPT and Microsoft 365 Copilot desktop applications
Risk domain
Access control and permissions › Credential theft
Also touches
Data exfiltration channels, Confused deputy, Data and memory poisoning
System type
Generative model
Who acted
AI was the target — local host compromise harvesting tokens from LLM desktop apps
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Local host compromise
Impact type
Session hijack, Data exfiltration, Integrity violation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any user of the Electron/WebView-based LLM desktop clients on a compromised endpoint
Capability abused
Defense & remediation
Recorded defense
OS-level credential protection
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
none - all three vendors closed the reports as informational / out of scope
Taxonomy & references
Curator notes
Lumia Security. Anthropic (HackerOne), MSRC and OpenAI (BugCrowd) all declined to treat it as a security boundary violation. ATLAS dates the case study to 2025 with year granularity; date_disclosed set to the ATLAS November 2025 publication month.
Supporting sources
Cite as
Enkrypt AI. "AIKatz: harvesting authentication tokens from ChatGPT, Claude and Copilot desktop apps to hijack LLM sessions". AIR, AIR-2025-0164. https://agentincident.vercel.app/i/AIR-2025-0164/ (accessed 2026-10-19).