← Catalog
Research high discovered 2025-01-01

AIKatz: Stealing Auth Tokens from LLM Desktop Applications

Researchers extracted authentication tokens from the memory of LLM desktop apps (Claude, ChatGPT, Copilot). With a stolen token, an attacker impersonates the victim to the LLM backend — lateral movement into the user's AI account.

Discovery Lateral Movement Defense Evasion Impact

What happened

Researchers at Lumia demonstrated (MITRE ATLAS AML.CS0036) — under the name AIKatz, a nod to Mimikatz — that authentication tokens can be extracted from the memory of LLM desktop applications such as Claude, ChatGPT, and Copilot. After discovering and reading the target process, the attacker recovers the app’s access token and uses it to impersonate the victim to the LLM backend, gaining the victim’s access and history.

This shifts AI attacks onto the endpoint: the model isn’t tricked at all: the client’s credential material is stolen and replayed, moving the attacker laterally into the user’s AI account and its connected data.

Why it maps to ATLAS

  • AML.T0089 — Process Discovery (Discovery): the LLM desktop process is located and inspected.
  • AML.T0091.000 — Use Alternate Authentication Material: Application Access Token (Lateral Movement): the stolen token is replayed to impersonate the user.
  • AML.T0092 — Manipulate User LLM Chat History (Defense Evasion): history can be altered to hide activity.
  • AML.T0048.003 — External Harms: User Harm (Impact): the victim’s account and data are exposed.

Detection notes

Because the credential is a legitimate token, backend logs look normal unless you bind sessions to a device/context. Protect token storage (OS keychain, not plaintext memory), keep tokens short-lived, and anomaly-detect backend sessions by device, geo, and behavior. On the endpoint, memory reads against LLM desktop apps are a strong signal.

Detection

Log sources

  • Endpoint process + memory-access telemetry
  • LLM backend auth/session logs
  • Device/session binding signals

Signals

  • Process memory reads targeting LLM desktop applications
  • Backend sessions using a token from an unexpected device or geo
  • Chat history manipulation inconsistent with the user's activity

Mitigations

  • Bind tokens to device/session; short-lived tokens with rotation
  • Protect token storage (OS keychain, encryption at rest, not plaintext memory)
  • Anomaly-detect backend sessions by device, geo, and behavior