Wiz maps how stolen credentials reach cloud, code and AI systems

Cloud security firm Wiz published research on 25 September 2026 that maps the types of credentials targeted by infostealer malware families and assesses what access those stolen secrets could give an attacker across cloud accounts, source code repositories and AI environments. The work is based on data from NordStellar, a threat exposure platform, according to Wiz.

Infostealers are a category of malware that runs on an end user's machine and harvests saved secrets such as browser passwords, session cookies, tokens and configuration files. The significance for agentic systems is straightforward: the same developer laptop that holds a cloud login often also holds API keys for model providers and access to the code repositories where agent logic and prompts live. Wiz's stated focus is on tracing that chain, from the credential a stealer grabs to the environment it can open.

Wiz frames the research around potential impact rather than confirmed breaches. The published summary describes an analysis of which credential types different infostealer families go after, and an assessment of how those credentials map onto cloud, code and AI environments. It does not, in the material published, name affected organisations, quantify the number of stolen credentials examined, or attribute activity to a specific group. Readers should treat the findings as an exposure assessment of what stolen credentials could reach, not a tally of incidents.

The inclusion of AI environments alongside cloud and code is the notable part for teams running agents in production. AI provider keys are typically long-lived bearer tokens: anyone holding the string can use it until it is rotated. They are frequently stored in plain text in environment files, shell profiles and local configuration, which is exactly the kind of location infostealers are built to sweep. An agent platform that is well defended at the network edge can still be reached through a stolen key sitting on a contractor's machine.

The practical implications follow from the same logic. Credentials that never expire are worth more to a thief than credentials that do. Secrets kept in a managed vault and injected at runtime are harder to sweep than secrets written to a file in a home directory. And spend or usage monitoring on model provider accounts is one of the few signals that a key is being used by someone other than its owner, because a stolen API key otherwise produces traffic that looks like normal application traffic.

Wiz describes the work as an analysis of NordStellar data by its own research team. The company has not, in this publication, disclosed a vulnerability in any named product, and nothing in the summary indicates a flaw in a particular AI vendor's service. The subject is the credential layer around those services, which sits largely on endpoints that security teams running agent infrastructure may not control directly.