AI coding assistants stopped being simple autocomplete widgets a long time ago. They index your repositories, read your environment variables, suggest shell commands, and whisper fixes into your terminal. They live in the same memory space as your source code, your local tokens, your cloud CLI configurations, and your SSH keys. That proximity makes them part of your attack surface in a very direct way, not a theoretical one.
Most teams adopted these tools in a rush. A developer installs an extension, authenticates with a personal access token, and starts accepting AI-generated suggestions. Security reviews rarely keep pace. Two recent threats, Djinn Stealer and ChocoPoC, show exactly why that gap is dangerous.
The Neighbor You Forgot to Vet
Think about where your assistant actually sits. If you use GitHub Copilot, Cursor, Continue, or any similar tool, it likely has read access to your open files, your project structure, and sometimes your entire local file system. It stores authentication tokens in predictable locations on disk. It runs inside your IDE, which itself runs with your user permissions. That means a piece of malware that compromises your workstation does not need to hunt blindly for credentials. The AI assistant has already gathered the interesting keys into one convenient place.
This is not a hypothetical architecture flaw. Djinn Stealer is built to exploit exactly this layout. It targets developer credentials and AI tool sessions specifically. Rather than scraping every corner of a file system, it goes after the tokens that power your coding workflow. If your assistant is authenticated to GitHub, GitLab, or a cloud provider, stealing that session gives an attacker more than code. It gives them your identity. They can push commits in your name, read private repositories, and probe the same APIs you use daily.
Djinn Stealer: Hunting the Keys to Your Kingdom
When Djinn Stealer lands on a machine, it behaves like a smart burglar who knows which drawers hold the spare keys. It looks for AI tool configuration directories, browser session stores, and credential files that developers accumulate over months of work. The stealer knows that modern development environments centralize access. One OAuth token for your AI assistant can overlap with access to package registries, container repositories, and infrastructure APIs.
The risk multiplies when developers test proof-of-concept code locally. You clone an interesting repository from a security researcher, run a script to see how it works, and the script quietly executes a credential harvester in the background. Because your AI assistant's tokens live in standard paths under your home directory, the stealer can exfiltrate them before you finish reading the README. The worst part is that these tokens often bypass corporate SSO because they were generated for productivity tools, not production systems.
ChocoPoC: When Dependencies Lie
While Djinn Stealer raids the house, ChocoPoC sneaks in through the mail slot. This threat hides malicious paths inside Python dependencies, specifically packages named frint and skytext. The payload does not sit in the visible script where a casual review might catch it. Instead, it buries itself deeper,