Remus: Infostealers Target AI Client Credentials and Local History

On client-managed MCP caches and temporary artifacts, inventory exact paths, minimize sensitive retention, enforce policy-bound expiry and verify deletion across restarts and cleanup failure. Shorter retention materially reduces historical content available to a later file collector. This owns client artifacts, not browser-wide history or every Codex/Cursor/OpenCode transcript; an active infostealer can still read data before expiry. Client developers can redact secrets and unnecessary personal data before writing client-owned MCP logs, rather than waiting for retention expiry. Test synthetic credentials through nested log fields and failure paths, and inspect the actual files. This reduces the sensitive content a later file collector can obtain from those logs; it does not sanitize every product conversation database, live memory or original credential file.

After credible theft evidence, use a clean administrative environment to identify and replace the exact affected long-lived AI API keys or client secrets at their issuers, then test denial of the old credentials and least-privilege operation of replacements. The AWS example needs provider-specific adapters for the actual AI services. This contains future credential reuse; it does not remove host malware or recover exfiltrated files.

For defender-managed MCP client credentials, replace plaintext configuration secrets with scoped OS-keychain or managed-secret references, deny plaintext fallback and verify access under an unauthorized identity. This removes a file-collection target only where the client actually supports that integration. It does not stop same-user malware able to unlock the keychain, intercept retrieval or read process memory, and is not a retrofit claim for every named AI product.