Gen Digital: Infostealers (CallbackBeaver, Amatera, Remus, Djinn) Now Harvest AI Coding-Agent Tokens, MCP Configs and Prompt Histories
Gen Digital: Infostealers (CallbackBeaver, Amatera, Remus, Djinn) Now Harvest AI Coding-Agent Tokens, MCP Configs and Prompt Histories is a high-severity credential theft issue in Not, a MCP server. Affected: Not version-specific; targets locally stored agent tokens, MCP configs and history files.. It has been exploited in the wild.
Is Not running on your developers' machines? Anomity finds every device with this MCP server installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
gen-digital-infostealers-callbackbeaver-amatera-remus-djinn-now-harvest- Severity
- high
- Attack type
- Credential theft, Malware
- Component
- Not · MCP server
- Known exploited
- Yes
- Published
- Last verified
What is this vulnerability?
Gen Digital threat research team lead Jan Rubín reported on 8 September 2026 that infostealer families have added AI coding agents to their collection targets. CallbackBeaver added Cursor and Claude, with more than 5,000 samples observed in a recent 30-day period; Amatera targets Cline and Continue; Remus targets Claude, Cursor and OpenCode; and the macOS stealer Djinn is associated with Claude, Codex, Gemini, Cline, OpenCode and Kilo. Lower-prevalence families (BeeStealer, STG, HydraStealer, APEX, Otter) show the behaviour spreading. What is taken: access and refresh tokens, MCP configuration credentials (endpoints, headers, environment variables, API keys), prompt histories and conversation databases, and account, organization and billing details. Gen says AI-agent data has appeared in another stealer's collection rules almost every day. Over three months its Windows telemetry recorded Amatera and Remus detections among tens of thousands of protected users (detections, not confirmed infections). The post gives no exact file paths, since they vary by product, OS and settings, and stresses that resetting browser passwords alone does not clean up after an infection.
Affected versions
| Affected | Fixed in |
|---|---|
Not version-specific; targets locally stored agent tokens, MCP configs and history files. | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run Not version-specific; targets locally stored agent tokens, MCP configs and history files..
How do I fix it?
Inventory which AI agents run on endpoints and where each stores tokens, history and MCP credentials, and prefer OS keychains over plaintext token files. Use short-lived, scoped tokens for MCP servers, keep personal and production access separate, and revoke unused connections. Keep secrets out of prompts, and delete or rotate any that appear in local histories. After an infostealer infection, revoke AI-service sessions, rotate MCP-related API keys, review connected apps and check whether local prompt histories exposed company data, in addition to resetting browser passwords. Harden endpoints against the usual delivery routes: ClickFix/FakeCaptcha lures, cracked software and unofficial installers.
How do I find every machine running Not?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Not and which version, then enforce a policy on it.