AI

AI Dev Tools Weaponized: Codex Credentials Stolen at Scale

Malicious npm package → 29K weekly users' tokens silently exfiltrated

Level 1

Dev Tool Hijacked, Tokens Stolen

A malicious npm package called codexui-android, downloaded over 29,000 times weekly, was silently stealing OpenAI Codex authentication tokens and sending them to an attacker-controlled server. The attack went undetected for roughly a month, with the malicious code injected after the package had already built a legitimate user base. Affected tokens include non-expiring refresh tokens, meaning attackers can impersonate victims indefinitely.

Bullets

  • 29,000+ weekly downloads of the poisoned npm package codexui-android
  • Tokens exfiltrated to a server disguised as Sentry at sentry.anyclaw[.]store
  • Refresh tokens do not expire, enabling persistent unauthorized access
  • A linked Android app also carried the same exfiltration payload

Key Points

  • OpenAI Codex developer credentials stolen at scale via a trojanized npm package
  • Non-expiring refresh tokens give attackers indefinite impersonation capability
  • Attack vector spans npm ecosystem and Android app distribution simultaneously

Timeline

Apr 2026

codexui-android first published on npm by account friuns

Apr 12 2026

Domain anyclaw[.]store registered, coinciding with package upload

May 2026

Malicious exfiltration code injected roughly one month after initial publication

Jun 2 2026

Aikido Security researcher Charlie Eriksen publicly discloses the campaign

Sources

Dataconomy

1 day ago

Aikido Security

1 day ago

Dataconomy

1 day ago

Level 2

Why Every AI Dev Is at Risk

This attack exploits a structural weakness in how developers trust the open-source package ecosystem, using a fully functional tool to mask credential theft. The timing of the malicious injection, after the package had accumulated trust, reflects a deliberate delayed-activation strategy increasingly common in supply chain attacks. With OpenAI Codex now generally available on AWS Bedrock and embedded in enterprise IDE workflows, the blast radius of credential theft at this layer is no longer limited to individual developers but extends into corporate infrastructure.

Key Points

  • Delayed injection after trust-building is a maturing supply chain attack pattern, not a one-off incident
  • Non-expiring refresh tokens transform a one-time breach into a permanent access foothold
  • The attack surface spans npm, GitHub, and Android app stores simultaneously, complicating detection and remediation
  • OpenAI Codex landing on AWS Bedrock for enterprise use means stolen tokens could yield access to production-grade AI pipelines
  • OpenAI itself warns auth.json must be treated like a password, yet it is stored in plaintext by default

Sources

Dataconomy

1 day ago

Aikido Security

1 day ago

Dataconomy

1 day ago

Level 3

What Changes for Builders

This incident forces a reckoning across the AI developer toolchain: credential hygiene, package vetting, and default storage practices are all exposed as inadequate for the current threat environment. Enterprises that have integrated Codex into CI/CD pipelines via IDE plugins now face an urgent audit requirement. The simultaneous discovery of the Google API key revocation delay and similar AWS access key lag reveals that credential lifecycle management across the cloud industry is systemically broken.

Key Points

  • AI dev tool ecosystems lack the credential-isolation standards required to safely handle non-expiring tokens
  • Enterprise Codex deployments on AWS Bedrock raise the stakes of any future supply chain compromise at this layer
  • Plaintext local credential storage remains an unresolved design flaw across OpenAI, Google, and AWS tooling

Timeline

Apr 2026

codexui-android published; anyclaw[.]store domain registered same month

May 2026

Malicious credential exfiltration code silently injected into the package

May 2026

OpenClaw Android app and BrutalStrike Codex app identified as secondary vectors using same payload

Jun 2 2026

Aikido Security publishes full disclosure; AWS simultaneously announces Codex GA on Bedrock

Key Actors

Charlie Eriksen

Lead threat researcher, Aikido

Aikido Security researcher who identified and disclosed the malicious package campaign

Igor Levochkin

Suspected threat actor

npm account owner friuns linked to the malicious codexui-android package

OpenAI

Affected platform vendor

Developer of Codex whose authentication credential storage practices are under scrutiny

Aikido Security

Threat intelligence discloser

Security firm that uncovered and publicly disclosed the supply chain attack

AWS

Enterprise distribution channel

Cloud provider now hosting Codex on Amazon Bedrock, expanding enterprise exposure surface

What This Means

AI dev toolchains are now active high-value attack surfaces

Tech

The combination of non-expiring tokens, plaintext local storage, and npm's open publishing model creates a reproducible, scalable attack template. Security teams must treat AI coding agent credentials with the same rigor as cloud IAM keys.

Startups building on Codex face compounded risk exposure

Startups

Early-stage teams with limited security resources are disproportionately likely to have installed convenience packages without vetting. A stolen Codex token inside a startup's dev environment can yield access to proprietary codebases and AI pipeline configurations.

Trust in AI developer tooling becomes a competitive differentiator

Markets

Enterprise procurement cycles for AI coding agents will increasingly include security posture evaluation. Vendors who can demonstrate credential isolation and token rotation by default will gain ground against incumbents exposed by incidents like this.

Sources

Dataconomy

1 day ago

Aikido Security

1 day ago

Dataconomy

1 day ago

winners

  • Security audit and SAST tooling vendors whose scans can detect late-injected obfuscated code
  • Credential vaulting and secrets management platforms such as HashiCorp Vault and AWS Secrets Manager
  • Competing AI coding agents with stronger token isolation architectures who can market the contrast

losers

  • Individual developers who trusted an actively maintained, GitHub-clean package and may now have persistent attacker footholds
  • OpenAI Codex adoption momentum, particularly among enterprise security-conscious buyers evaluating AWS Bedrock onboarding
  • npm as a trusted distribution channel, further eroding developer confidence in open registry integrity

implications

  • AI-specific credential standards are now a commercial necessity, not a best-practice recommendation
  • Package registries will face regulatory and enterprise pressure to implement mandatory delayed-injection detection and code-change auditing

minority report

  • The account owner's claim of losing npm access, if true, reframes this as a compromised maintainer account rather than an intentional insider attack, which would shift blame from a malicious developer to a broader account security failure at npm
  • If maintainer compromise rather than deliberate malice is the root cause, the policy response should target npm account security standards rather than developer vetting, producing a materially different regulatory and technical remediation path

Level 4

Second-Order Shockwaves Incoming

The codexui-android campaign is likely the first publicly documented instance of AI agent credential theft at scale, but it will not be the last. As OpenAI Codex, GitHub Copilot, and competing agents proliferate across enterprise IDE stacks and cloud platforms, the credential surface area expands proportionally. The delayed-injection technique used here is already well understood by sophisticated threat actors and will be replicated across other AI tool ecosystems. Regulatory bodies and cloud providers will be forced to respond, but the window between exploitation and remediation is currently measured in months.

Timeline

Apr 2026

Package published and domain registered; exfiltration infrastructure pre-positioned

May 2026

Malicious code injected after one month of legitimate operation and trust accumulation

Jun 2 2026

Public disclosure by Aikido Security; AWS announces Codex GA on Bedrock same day

Jun 2026

npm account owner claims investigation; partial removal of malicious code begins

Q3 2026

Anticipated regulatory and enterprise policy responses targeting AI toolchain credential standards

Key Actors

Charlie Eriksen

Lead threat researcher, Aikido

Aikido Security researcher who identified and disclosed the malicious package campaign

Igor Levochkin

Suspected threat actor

npm account owner friuns linked to the malicious codexui-android package

OpenAI

Affected platform vendor

Developer of Codex whose authentication credential storage practices are under scrutiny

AWS

Enterprise distribution channel

Cloud provider now hosting Codex on Amazon Bedrock, expanding enterprise exposure surface

npm registry

Compromised distribution vector

Open package repository through which the malicious package was distributed to 29,000 weekly users

What This Means

AI agent authentication must be redesigned for adversarial environments

Tech

The current model of locally cached, plaintext, long-lived tokens is architecturally incompatible with a world where developers routinely install unvetted third-party packages. Short-lived tokens with hardware-backed storage must become the default, not an optional hardening step.

AI developer tool security becomes a VC and enterprise due diligence category

Markets

Investors and enterprise buyers will begin requiring security architecture documentation from AI coding agent vendors. Startups in the AI dev tool space that cannot demonstrate credential isolation will face deal friction and slower sales cycles.

Package registries face incoming regulatory scrutiny

Policy

The EU Cyber Resilience Act and US CISA secure-by-design guidance are on a collision course with npm's open publishing model. This incident provides concrete evidence regulators will cite when pushing for mandatory code-change auditing and maintainer identity verification on public registries.

Detected Trends

AI Toolchain Supply Chain Attacks

accelerating

Threat actors are shifting from traditional software supply chain targets to AI-specific developer tools, exploiting trust in actively maintained packages and the high credential value of AI agent tokens.

Delayed-Injection Malware Technique

accelerating

Attackers are publishing legitimate, functional packages first to build download volume and community trust, then injecting malicious code in a subsequent update, defeating pre-publication security scans.

Non-Expiring Token Exploitation

emerging

As AI platforms issue long-lived or non-expiring refresh tokens for developer convenience, these become high-value persistent access credentials that can be harvested and monetized at scale.

Cross-Platform Credential Exfiltration

emerging

Single malicious npm packages are being reused across Android applications and desktop environments, multiplying the distribution surface of a single compromise payload.

Sources

Dataconomy

1 day ago

Aikido Security

1 day ago

Dataconomy

1 day ago

second order

  • Enterprise security policies will begin mandating allowlists for AI coding agent plugins, slowing adoption velocity for third-party tool ecosystems built around Copilot, Codex, and Cursor
  • npm and PyPI will face mounting pressure from enterprise customers and insurers to implement mandatory post-publication code-diff auditing, potentially restructuring open registry governance
  • The Google API key revocation lag and AWS access key delay issues, surfaced alongside this incident, signal that credential lifecycle management is a systemic cloud industry failure with compounding exposure across incidents

prediction

  • Within 6 months, at least one major enterprise will disclose a confirmed data breach traceable to a stolen AI coding agent token, accelerating regulatory action on AI toolchain security standards
  • OpenAI will be compelled to introduce short-lived token rotation and hardware-backed credential storage as default behavior for Codex, reshaping authentication UX across its developer product line
  • A wave of similar delayed-injection attacks targeting Copilot, Cursor, and Windsurf extension ecosystems will be disclosed, establishing AI dev tool credential theft as a defined threat category

minority report

  • The 29,000 weekly download figure may significantly overstate actual victim count, as npm download metrics include CI/CD bots, mirrors, and automated scans that do not represent live developer environments with real credentials present
  • If actual human exposure is a fraction of the headline number, the immediate blast radius may be far smaller than the disclosure implies, and the more important story is the systemic vulnerability rather than this specific incident's impact

Level 5

The Strategic Fault Line

This incident marks a structural inflection point: the AI developer toolchain is now a primary target category for credential theft, not an ancillary concern of general software supply chain security. The convergence of three forces, the proliferation of AI coding agents across enterprise stacks, the structural insecurity of open package registries, and the issuance of non-expiring high-privilege tokens, creates a threat environment that existing security frameworks were not designed to address. Organizations that treat this as an isolated npm incident rather than a systemic architecture failure will be repeatedly exposed. The simultaneous GA launch of Codex on AWS Bedrock is not ironic timing but a signal of how quickly the enterprise attack surface is expanding relative to the maturity of defenses.

Timeline

Apr 2026

Package published; exfiltration domain registered within days of first npm upload

May 2026

Delayed-injection malicious code added; silent exfiltration begins across all 29,000 weekly installs

Jun 2 2026

Aikido Security discloses campaign publicly; AWS simultaneously launches Codex on Bedrock

Jun 2026

Package author begins partial remediation; full scope of credential theft unquantified

Q3 2026

Expected enterprise policy and regulatory responses targeting AI toolchain authentication standards

Key Actors

Charlie Eriksen

Lead threat researcher, Aikido

Aikido Security researcher who identified and disclosed the malicious package campaign

OpenAI

Affected platform vendor

Developer of Codex whose authentication credential storage practices are under scrutiny

AWS

Enterprise distribution channel

Cloud provider now hosting Codex on Amazon Bedrock, expanding enterprise exposure surface

npm registry

Compromised distribution vector

Open package repository through which the malicious package was distributed to 29,000 weekly users

Aikido Security

Threat intelligence discloser

Security firm that uncovered and publicly disclosed the supply chain attack

What This Means

AI agent authentication architecture is a critical unresolved vulnerability

Tech

The combination of non-expiring refresh tokens, plaintext local storage, and open package distribution is an architecture that cannot be patched at the edges. Platform vendors must redesign credential issuance and storage from the ground up, treating the developer environment as an untrusted surface.

Regulators now have a concrete case for AI toolchain security mandates

Policy

The EU Cyber Resilience Act, CISA secure-by-design initiatives, and emerging AI-specific security frameworks all lack binding requirements for AI coding agent credential standards. This incident provides the documented precedent regulators need to advance mandatory token lifecycle and registry auditing requirements.

Security posture becomes a primary AI dev tool selection criterion

Markets

Enterprise procurement for AI coding agents is entering a phase where credential architecture, token rotation defaults, and supply chain provenance will be evaluated alongside capability benchmarks. Vendors who invest in security-first credential design now will capture enterprise deals that security-laggard competitors lose in compliance reviews.

Detected Trends

AI Toolchain Supply Chain Attacks

accelerating

Threat actors are shifting from traditional software supply chain targets to AI-specific developer tools, exploiting trust in actively maintained packages and the high credential value of AI agent tokens.

Delayed-Injection Malware Technique

accelerating

Attackers publish legitimate functional packages first to build volume and trust, then inject malicious code in a subsequent update, systematically defeating pre-publication security scans.

Non-Expiring Token Exploitation

emerging

As AI platforms issue long-lived or non-expiring refresh tokens for developer convenience, these become high-value persistent access credentials that can be harvested and monetized at scale.

Cross-Platform Credential Exfiltration

emerging

Single malicious npm packages are being repackaged inside Android applications, multiplying distribution surface and defeating platform-level pre-publish scans through sandboxed execution.

Sources

Dataconomy

1 day ago

Aikido Security

1 day ago

Dataconomy

1 day ago

implications

  • AI platform vendors must treat developer credential storage as a first-class security surface, moving to short-lived token architectures with automated rotation before enterprise procurement standards force the issue
  • CISOs integrating AI coding agents into production developer environments must implement network egress monitoring specifically for credential file access patterns, as existing SAST and SCA tools demonstrably failed to catch this payload
  • The open registry model, where any actor can publish updates to a trusted package without post-publication diff auditing, is incompatible with the security requirements of AI tooling that handles persistent high-privilege credentials

second order

  • AI coding agent credential theft will become a standardized initial access technique in nation-state and organized cybercrime playbooks, targeting the developer layer as a privileged entry point into enterprise AI infrastructure rather than targeting the AI platforms themselves
  • The insurance and compliance industries will drive faster change than regulators: cyber insurers will begin requiring evidence of AI toolchain credential hygiene as a policy condition, creating financial incentives that outpace legislative timelines
  • Open source AI tooling ecosystems will bifurcate into vetted enterprise distributions and unvetted community editions, with security-conscious enterprises paying premiums for audited package mirrors, reshaping the economics of AI developer tool monetization

minority report

  • The most strategically significant reading of this incident is not that npm is broken or that OpenAI tokens are insecure, but that security researchers and the open source community detected, disclosed, and began remediating this attack within a month of injection, which is faster than most enterprise internal security teams would have caught an equivalent insider threat
  • This outcome argues that transparent, open ecosystems with active security researcher communities may produce faster threat response than closed enterprise toolchains with proprietary auditing, suggesting the policy response of locking down open registries could paradoxically reduce overall security by removing the researcher visibility that made this detection possible