On 30 August, Anthropic started reaching out to Claude users whose computers had been infected with infostealer malware. The malware had copied their active Claude login session cookies. With those cookies, attackers could replay an authenticated session and burn through the victim’s paid usage limits without ever typing a password.
The families involved are the ordinary ones: Vidar, Lumma, StealC, RedLine and Acreed on Windows, Atomic Stealer on macOS. These have been quietly hoovering up saved passwords, browser cookies and locally stored credentials from infected machines for years. Nothing about the technique is new. What is new is what the stolen cookie is now worth.
Anthropic was direct about where the fault sits, and it is worth quoting because the instinct will be to read this as a breach of Claude: “We have no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude.” The company is signing affected users out, removing saved payment methods from their accounts, and refunding charges it identifies as unauthorised.
Why two-factor did not help
This is the mechanic worth internalising, because it applies to every tool you are signed into. Infostealers do not steal your password. They steal the session cookie your browser holds after you have already logged in and already cleared two-factor. Replaying that cookie puts the attacker inside an authenticated session. There is no second login for 2FA to challenge, and no fresh SSO handshake for your identity provider to see.
So the security control most people believe is protecting their AI accounts — a code from an app, a passkey, a corporate SSO tile — is structurally irrelevant to this attack. It defends the front door. The cookie is a copy of the key to a door you already walked through.
Our take: The genuinely new thing here is the incentive. Historically, a stolen session cookie was worth whatever data sat behind it. An AI subscription is different: it is a metered account with a card attached and a resale market for the compute. That converts every AI login into a directly monetisable target, independent of whether your data is interesting. Assume the attack surface of your AI stack is no longer “what could they read” but “what could they spend.”
The symptom you would have dismissed
Anthropic named the tell, and it is the kind of thing almost everyone would have written off as a billing quirk: usage limits that appear to refill and then drain while you are not using Claude. If you have been quietly irritated over the past few weeks that your limits vanished faster than your work explained, that is now a specific thing to check rather than a vague annoyance.
The broader pattern is one we have been tracking all year. AI tooling has accumulated long-lived sessions, standing permissions and machine credentials far faster than anyone has built the hygiene to manage them — agents holding keys to everything, MCP servers shipping with known vulnerabilities, tokens that outlive the project that created them. A stolen cookie is simply the cheapest version of that problem.
What to watch
- Whether other AI providers follow. Nothing about this is Anthropic-specific. Every metered AI account with a saved card has the same exposure; Anthropic is just the one that noticed and told people.
- Session lifetime policy. The practical fix is shorter sessions and device binding, both of which trade convenience for safety. Watch which vendors are willing to make you log in more often.
- Refund scope. Anthropic is refunding charges it can identify as unauthorised. The gap between fraudulent usage and identifiable fraudulent usage is where the disputes will be.
- Your own machine first. The compromise was on user endpoints, not the provider. Signing out everywhere is pointless until the infostealer is off the device — it will simply take the next cookie.