Anthropic has told affected Claude users that a bad actor is using commodity infostealer malware to lift active login sessions off their own computers and then spend their usage. The interesting thing about it is how ordinary it is: no model was manipulated, no prompt was injected, no API was abused. Somebody’s laptop got infected with the same malware that has been stealing banking cookies for a decade, and the AI subscription happened to be sitting in the same browser profile. This piece covers what Anthropic actually said, why a stolen cookie beats a stolen password, the named malware families, what the loss really is, why AI credentials are now a workstation problem, what Anthropic can and cannot do about it, and what to do on your own machines.
What Anthropic actually told users
The notice went out by email, and the description is blunt. Anthropic describes "a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers, then using those login sessions to access Claude accounts and consume their usage."
It also explains what the malware does generally, which is worth quoting because it is the whole mechanism: this class of software "steals information stored locally, including browser passwords, login cookies, and credentials belonging to other apps."
And it draws a line that deserves to be repeated rather than buried, because the instinct on reading a headline like this is to assume the vendor got breached. Anthropic says it has "no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude." Nothing in the reporting contradicts that. The compromise is on the endpoint, and Claude is downstream of it.
The symptom users noticed is oddly specific and worth memorizing, because it is the kind of thing people dismiss: usage limits that "looked like they refilled and then drained while you weren’t using Claude."
Why a stolen cookie beats a stolen password
The password was never the target, and this is the part that most coverage skips past.
When you sign in, the service hands your browser a session token and stores it as a cookie. That token is the proof of the sign-in, not the password. It already reflects the fact that you passed multi-factor authentication. Anything holding a valid token is, as far as the service can tell, you, already authenticated, already through the second factor.
So an attacker who copies that cookie does not log in. There is no login to observe, no failed attempt to rate-limit, no unusual-location prompt on a sign-in that never happens, and no second factor to satisfy because the second factor was satisfied by the legitimate user hours earlier. Multi-factor authentication is not defeated here. It is skipped.
This is why "turn on MFA" is not the takeaway. It is good advice for other reasons and it would not have prevented any of this. We made a related point about the limits of factor choice in the Microsoft SMS MFA retirement: moving people to stronger factors improves the sign-in, and session theft is an attack that happens after the sign-in has already succeeded.
The named families, and what that tells you
Anthropic named the strains it saw. On Windows: Vidar, LummaC2, StealC, RedLine and Acreed. On macOS: Atomic Stealer, on what it describes as a small number of Macs.
None of these are new, none are targeted, and none were written with AI accounts in mind. They are commodity crimeware sold to whoever wants it, and they hoover up whatever is on the machine. That the haul now includes an AI subscription is a change in what is worth stealing, not a change in how it gets stolen. One affected user reported tracing the infection to a pirated game, which is the most ordinary infection story there is.
The Mac detail is worth noting for anyone still carrying the assumption that this is a Windows problem. It is a smaller number, and it is not zero.
The loss is metered spend, which is a genuinely new shape
Most account-compromise stories are about data. This one, so far, is about consumption.
The attacker is burning usage. For a subscriber that means hitting limits you did not hit. For anyone on metered billing it means charges. Anthropic is refunding what it identifies as unauthorized, which tells you money moved.
That makes an AI account a slightly strange asset: it is valuable to steal not because of what is stored in it but because of what it can be made to do, and the cost of that doing lands on the victim automatically. It behaves less like a hacked email account and more like a stolen utility meter.
The honest caveat is that nobody has established the boundary. Reporting has not settled whether attackers read conversation history, exported anything, or simply consumed. A session token that can spend can generally also read, so the prudent assumption is that anything in the account was reachable. Anthropic has not published a figure for how many accounts were affected, and no independent count exists.
Infostealers make AI credentials a workstation asset class
This is the part that generalizes past Claude, and past this incident.
For two years the security conversation about AI tools has been about the models: prompt injection, jailbreaks, what the model will say, what an agent will do if you trick it. We have written that story repeatedly, including in agent runtime security, where the argument was that the exploitable surface had moved from the model to the software around it. This incident moves it one step further out again, to the workstation, where it has always been.
Think about what now sits in a working developer’s browser profile and local config: an AI subscription session, API keys in a dotfile, a token for whatever agent framework is installed, credentials for the package registries we covered in the package registry attack surface, and a local model server of the kind described in local AI agent security. Commodity infostealers already collect browser cookies and application credentials indiscriminately. They did not need an update to start collecting these.
The practical consequence is that AI tooling credentials belong in the same inventory as any other secret on the endpoint, and most organizations have not put them there. They are frequently personal accounts, frequently expensed rather than provisioned, and frequently invisible to whoever manages identity.
What Anthropic is doing, and the sentence it added
The response is what it should be. Anthropic is revoking compromised sessions, signing affected users out, removing saved payment methods from affected accounts, and refunding charges it identifies as unauthorized.
Then it adds the sentence that makes the notice worth respecting: "Signing you out of Claude stops the stolen sessions, but it doesn’t remove the malware."
That is the whole problem stated plainly by the party with the least incentive to state it. Every remedy available to a service provider operates on the service. None of them operate on the infected machine. The account can be secured repeatedly and re-compromised each time, because the thing doing the stealing is still running and still collecting whatever the browser stores next.
Anthropic’s instructions to users follow from that: change credentials, revoke other sessions, and remove the malware. The third is the one that actually ends it, and it is the one the vendor cannot do for you.
What to do on your own machines
Treat a suspected infection as an endpoint incident, not an account incident. Rotating the Claude session while the stealer is resident just gives it something fresh to take.
Check for the symptom Anthropic described, because it is unusually legible: usage that moves when you are not using anything. On a metered plan, look at spend for hours you were not working.
Rotate more than the one account. An infostealer that reached your browser profile reached everything in it, so the exposure is every saved session and password on that machine, not the one that happened to send you an email. Assume the API keys and tokens in your local config are exposed too.
Take saved payment methods out of accounts that do not need them on file. Anthropic removed them from affected accounts for a reason, and the same reasoning applies before an incident rather than after.
For teams, the durable fix is knowing which AI tools your people actually sign into and on what devices. That is an inventory problem rather than a security-product problem, and it is unglamorous enough that almost nobody has done it.
Frequently Asked Questions
What is an infostealer?
It is a category of commodity malware that runs on a victim’s own computer and collects locally stored secrets. Anthropic’s description covers the scope: it “steals information stored locally, including browser passwords, login cookies, and credentials belonging to other apps.” These are sold as off-the-shelf crimeware rather than built for any specific target.
Was Claude or Anthropic breached?
No. Anthropic states it has “no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude,” and nothing in the reporting contradicts that. The compromise happens on the user’s machine, and the stolen session is then replayed against a service that has no way to distinguish it from the real one.
How did attackers get past multi-factor authentication?
They did not encounter it. A session cookie is issued after a successful sign-in and already represents a completed authentication, including the second factor. Replaying that cookie means no login event occurs, so there is nothing for MFA to challenge. This is why stronger factors would not have prevented it.
Which malware families were named?
Vidar, LummaC2, StealC, RedLine and Acreed on Windows, plus Atomic Stealer on what Anthropic describes as a small number of Macs. All are established commodity strains rather than anything purpose-built for AI accounts.
What did the attackers actually do with the accounts?
The confirmed behavior is consuming usage, which shows up as limits draining while the legitimate user is idle and, on metered plans, as charges. Anthropic is refunding charges it identifies as unauthorized. Whether attackers also read or exported conversation content has not been established publicly, and a session token that can spend can generally also read, so treat account contents as reachable.
How many accounts were affected?
Unknown. Anthropic has not published a number, and no independent count exists. Notifications went to affected users directly by email rather than through a public disclosure with figures attached.
Does signing out fix it?
Only partly, and Anthropic says so directly: “Signing you out of Claude stops the stolen sessions, but it doesn’t remove the malware.” Session revocation ends the current theft. If the stealer is still running on the machine, the next session is available to it as soon as you create one.
What should a team do about this beyond the individual fix?
Build an inventory of which AI tools staff sign into and on which devices, and treat those credentials as secrets on the endpoint alongside API keys and registry tokens. Much AI tooling is signed into with personal accounts on personally managed machines, which puts it outside whatever identity controls the organization already runs.
