AIKatz Extracts Authentication Tokens from LLM Desktop Apps
LLM Desktop Applications
Researchers demonstrated that authentication tokens can be extracted from LLM desktop application memory to impersonate victims and manipulate AI conversations. The attack allows prompt injection, context poisoning, and conversation history tampering.
- first report
- 7 Nov 2025
- last update
- 7 Nov 2025
Timeline · 2
Sources · 2
News and write-ups
- 2025-11-07AIKatz - All Your Chats Are Belong To Uslumia.security · lumia.security/blog/aikatz
Research and catalogues
- 2025-11-07AIKatz: Attacking LLM Desktop ApplicationsMITRE ATLAS · atlas.mitre.org/studies/AML.CS0036
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Research
- AI role
- Attack on AI
- categories
- Data leakAgent hijackPrompt injection
- severity
- 1 · Research / proof of concept
- targets
- Enterprise deployment
- owasp llm top 10
- LLM01:2025 Prompt InjectionLLM02:2025 Sensitive Information DisclosureLLM06:2025 Excessive Agency
- dates
- happened 2025 (approx.) · first reported 7 Nov 2025
- origin
- MITRE ATLASDerived from MITRE ATLAS (Apache 2.0, © MITRE).
- record
- confidence 0.95 · created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# AIKatz Extracts Authentication Tokens from LLM Desktop Apps https://gcdradar.vercel.app/incidents/aikatz-extracts-authentication-tokens-from-llm-desktop-apps · AIR-2025-0066 · closed 2025-11-21 - Lane: Research - Severity: 1 (Research / proof of concept) - Fix status: Fix status unknown - First reported: 2025-11-07 (happened 2025) - AI role: Attack on AI - Products: LLM Desktop Applications ## Summary Researchers demonstrated that authentication tokens can be extracted from LLM desktop application memory to impersonate victims and manipulate AI conversations. The attack allows prompt injection, context poisoning, and conversation history tampering. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2025-11-07: AIKatz - All Your Chats Are Belong To Us (https://lumia.security/blog/aikatz) - 2025-11-07: AIKatz: Attacking LLM Desktop Applications (https://atlas.mitre.org/studies/AML.CS0036) ## Sources - 2025-11-07 MITRE ATLAS: AIKatz: Attacking LLM Desktop Applications https://atlas.mitre.org/studies/AML.CS0036 - 2025-11-07 lumia.security: AIKatz - All Your Chats Are Belong To Us https://lumia.security/blog/aikatz Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closedSlack AI Data Exfiltration from Slack AI via Indirect Prompt Injection
Research · since 20 Aug 2024
AI - closedCopilot Studio Data Exfiltration via Prompt Injections in Copilot Studio Agent
Research · since Jun 2025 (approx.)
AI - closedCursor Data Exfiltration via MCP Server Prompt Injection Targeting Cursor
Research · since 24 Jun 2025
AI - closedLenovo AI Chatbot Lena Cross-Site Scripting via Prompt Manipulation in Lenovo AI Chatbot
Research · since 18 Aug 2025
AI - closedMCP SDKs Credential Exfiltration via Remote Poisoned MCP Tool
Research · since 1 Apr 2025
AI - closedClaude Code GitHub Action Claude Code GitHub Action Secret Exposure via Prompt Injection
Research · since 5 Jun 2026
AI