Decision RecordActivePublished without chair review
CRT-2026-039316 Oct 2026MORNING EDITIONDaily Roundtable
Developer workstation containment and trust recovery
Isolate and reimage the suspected workstation before rotating secrets. From a clean system, revoke repository, cloud, AI-assistant, build, release, signing, and workforce credentials or sessions that were accessible during the suspected compromise window. Audit repositories, builds, artifacts, releases, cloud activity, and unauthorized integrations before restoring trust.
Current public guidance · the full record
What to do now
At a glanceThe edition's authoritative action board carries no action for this record's subjects — no What to do now guidance.
Why now
Under reviewReporting available on 16 October 2026 described recent Aoki variants as targeting credential and session material associated with Claude, Codex, Cursor, Codeium, Gemini, GitHub Copilot, JetBrains AI Assistant, Kiro, and AWS.
If replacement credentials are entered while the suspected workstation remains infected, those replacements may also be exposed. Immediate isolation and rebuilding therefore precede rotation.
The same reported access creates a potential path from one developer workstation into repositories, cloud accounts, build systems, package publication, signing processes, releases, and workforce identity, making downstream audits necessary before trust is restored.
Who is affected
Partially supportedDevelopers using a workstation suspected of Aoki infection face possible exposure of credentials and sessions readable by their account or loaded in a browser, shell, SSH agent, IDE, or credential helper.
Operators of Claude, Codex, Cursor, Codeium, Gemini, GitHub Copilot, JetBrains AI Assistant, and Kiro deployments must identify and revoke sessions accessible from that workstation. AWS and other cloud administrators must examine accessible cloud credentials and activity.
Repository administrators must review tokens, sessions, integrations, and source changes. CI/CD and build operators must inspect pipeline secrets, configuration, runners, and build logs. Package and release operators must verify publication activity and artifacts.
Signing-key custodians must determine whether signing material or sessions were accessible and inspect signing use. Workforce identity teams must revoke accessible sessions and credentials.
Consumers of software produced through the affected repositories or pipelines face potential downstream risk if unauthorized source changes, builds, artifacts, or releases are found.
What supports this
SupportedSupport — The identity architect’s 16 October 2026 analysis reports that recent Aoki variants target credential and session files associated with Claude, Codex, Cursor, Codeium, Gemini, GitHub Copilot, JetBrains AI Assistant, Kiro, and AWS. It supports treating access readable by the developer account or loaded in the browser, shell, SSH agent, IDE, or credential helper as potentially exposed.
Support — The moderator’s 16 October 2026 synthesis identifies potential identity and software-supply-chain consequences while explicitly separating reported collection capability from proof that every signing key, CI/CD secret, or developer credential was stolen. It supports scoped revocation and downstream auditing rather than assuming universal compromise.
Support — The evidence audit found that the cited material consistently directs responders to isolate and reimage the suspected workstation before revoking credentials from a clean system, then audit repositories, cloud activity, builds, artifacts, releases, signing processes, and unauthorized integrations before restoring trust.
Evidence gap — The retrieval summary returned search results about Aoki and developer credentials but did not expose the underlying source findings. It does not independently verify the reported malware capabilities, so those claims remain attributed and conditional.
How the Roundtable reached this
Under reviewThe identity architect identified reported targeting of credential and session files associated with Claude, Codex, Cursor, Codeium, Gemini, GitHub Copilot, JetBrains AI Assistant, Kiro, and AWS, while stressing that collection capability does not prove every credential was stolen.
The moderator connected that exposure to possible identity and software-supply-chain compromise. The evidence audit found consistent support for isolating and reimaging the workstation before clean-system revocation and downstream audits, but flagged the absent authoritative Aoki report.
The boundary review resolved that gap by limiting revocation to access available during the suspected compromise window and keeping Aoki capability claims conditional. Retrieval found no comparable prior decision, and the arbiter selected a new operational decision on that bounded basis.
Positions are generated by AI specialist personas and chaired by Halil Öztürkci.
Panel composition
- Scout (AI panel role)Scout identified 6 candidate signals.
- Linker (AI panel role)Linker evaluated 6 relation judgments.
- Evidence Auditor (AI panel role)Evidence Auditor recorded 15 evidence signals; 9 gaps.
- Prediction Steward (AI panel role)Prediction Steward accepted 1 prediction and rejected 1 claim.
- Boundary Reviewer (AI panel role)Boundary Reviewer recorded 12 public/private findings.
- Arbiter (AI panel role)Arbiter produced 6 decision envelopes.
Key disagreement
Scout (AI panel role)
The malware's collection capability does not prove that every signing key, CI/CD secret, cloud identity, or developer credential on a particular workstation was stolen. Scope depends on what the developer account and active applications could access during the suspected compromise window.
Arbiter outcome
Arbiter outcome: new decision record. The evidence strongly supports a new operational decision covering workstation isolation, clean-system credential revocation, and downstream trust recovery. The remaining source gap is addressed through conditional capability wording.
Candidates considered
Considered 6 candidates · opened 1 · 5 not opened (5 other)
Considered, not opened
Sign in to preview Considered-Not-Opened entries (moves to Pro at launch).
Sign in to preview practitioner entries.
What is uncertain
MissingIt is uncertain whether Aoki actually collected or exfiltrated any particular repository token, AWS credential, AI-assistant session, CI/CD secret, package-release credential, signing key, SSH-agent identity, or workforce session from the suspected workstation.
Reported collection capability is not proof of theft. The response scope therefore depends on what the developer account and applications could read or had loaded in the browser, shell, SSH agent, IDE, or credential helper during the established compromise window.
Downstream repository modification, malicious builds, altered artifacts, unauthorized releases, cloud activity, and unauthorized integrations remain unproven until their audit trails are examined.
What evidence is missing
ConflictingThe packet does not contain the underlying authoritative Aoki malware report needed to independently verify the reported collection of Claude, Codex, Cursor, Codeium, Gemini, GitHub Copilot, JetBrains AI Assistant, Kiro, and AWS credential or session material.
It also lacks host-specific telemetry establishing the compromise window, which credentials or sessions were readable or active, and whether data was exfiltrated.
Repository, cloud, build, artifact, release, signing, package-registry, workforce-identity, and integration audit results are also absent, so the packet cannot establish whether downstream access or tampering occurred.
What would change this
Under reviewHost-specific evidence should change the scope, not the clean-system containment sequence.
Evidence that a credential, session, signing key, or service was inaccessible throughout the compromise window would support removing it from the revocation scope.
Evidence of broader account access, exfiltration, repository modification, cloud activity, unauthorized integrations, malicious builds, signing use, or artifact publication would require expanding revocation, rebuilding affected artifacts on clean runners, and reassessing releases before trust is restored.
An authoritative Aoki report that disproves or materially changes the reported capability set would change which named services receive capability-driven scrutiny, while confirmed access evidence would still govern the incident response.
What to watch next
Partially supportedWatch repository and cloud audit trails for activity during the established compromise window, including unauthorized source changes, access from unexpected sessions, new integrations, altered build configuration, unapproved artifact publication, release activity, and signing use.
Compare releases and artifacts with reviewed commits and clean build logs. Expand revocation and rebuilding if evidence shows broader access or downstream modification; narrow further work only when host-specific access evidence rules credentials or systems out.
Also watch for publication of an authoritative Aoki report that confirms or refutes the reported targeting of Claude, Codex, Cursor, Codeium, Gemini, GitHub Copilot, JetBrains AI Assistant, Kiro, and AWS material.
Evidence basis
Aoki broadens the incident from an infected developer workstation to a potential software-supply-chain and identity compromise. Recent variants reportedly target credential and session files associated with Claude, Codex, Cursor, Codeium, G…
Summary: Cisco Secure Email Gateway, PAN-OS, and Ivanti remain the immediate control-plane priorities, but exposure must be validated rather than inferred from internet reachability alone. Reporting on the French refrigeration incidents sup…
Public value history
- 16 Oct 2026Initial public guidanceCurrent guidance
Created the first public value version for this Decision Record.
Source RoundtableMorning roundtableConvened 16 Oct 2026Methodology
How the panel reaches a Public Decision Record.