This is a shocking and important warning. If you’re using AI, this is not someone else’s problem. According to KELA, which investigates cyber threats, more than 49,700 session cookies—indicating logged-in states on AI services— have been found on the dark web. This means attackers are stealing the actual logged-in sessions themselves— not just usernames or passwords, but the complete active session. Moreover, chat histories and prompts within AI services are also being targeted. This goes far beyond the issue of stolen passwords. Even if you have two-factor authentication (2FA) enabled, if an attacker gains access to an active session, they can exploit it without being prompted again for MFA. Individual users are also at risk— if your device becomes infected with malware, you could be targeted. Here are seven practical steps individuals should take: ① Keep your PC (Windows and browser) up to date. ② Keep your security software updated. ③ Do not install suspicious software or files. ④ Enable two-factor authentication on your AI accounts. ⑤ Use passkeys whenever possible. ⑥ Periodically check your “active devices” or “logged-in sessions.” ※ Look for sessions you don’t recognize. ⑦ If anything seems suspicious, log out of all sessions immediately. It’s not about avoiding AI—it’s about protecting the device you use to access it. Don’t rely on just one measure. The key is combining: • Stronger authentication, • Preventing device infection, and • Regularly monitoring active login sessions.