Anthropic is reportedly warning some Claude users that infostealer malware stole active login sessions and used them to consume Claude usage.
BleepingComputer reported on August 30 that Anthropic is signing affected users out of Claude, removing saved payment methods, and refunding charges it identifies as unauthorized. The report is based on an email Anthropic sent to an affected user and says the company is sending similar notices to other compromised account holders.
The important security lesson is not limited to Claude. Paid AI accounts are now valuable SaaS sessions. If malware steals a live browser session, an attacker may not need the user’s password or multifactor prompt to start spending the account’s quota.
Session theft bypasses the normal login story
Infostealers typically collect local browser data, saved credentials, cookies, and application tokens. BleepingComputer reports that Anthropic’s notice named Windows malware families including Vidar, LummaC2, StealC, RedLine, and Acreed, along with Atomic Stealer on a small number of Macs.
That attack pattern is different from a simple password compromise. A user can have a strong password and still lose an already-authenticated session if the endpoint is infected.
For AI subscriptions, the visible symptom may be strange usage behavior: limits refilling and draining while the user is away, unexpected charges, or forced sign-outs after vendor detection.
AI tools are now part of endpoint security
Claude, ChatGPT, Gemini, Copilot, Cursor, and similar tools increasingly sit next to source code, documents, credentials, customer context, and agent connectors. The account itself may have usage value, but the surrounding workspace can be worth more.
That makes local endpoint hygiene part of AI governance. A compromised developer laptop can expose more than a chat history. It can expose active AI sessions, browser tokens, repository context, MCP configuration, cloud consoles, package registries, and downstream tools the user granted to an agent.
The right response is therefore broader than resetting one AI password. Affected users need to remove the malware, revoke sessions, rotate credentials that may have been stored locally, and check payment and usage history.
The Claude brand has already been abused
The session-theft report follows a year of Claude-related abuse patterns. BleepingComputer previously reported fake Claude desktop installers promoted through Bing ads and Claude Artifact pages abused in ClickFix-style malware campaigns.
Those incidents are not the same as the current session-theft warning. But together they show why popular AI tools become phishing and malware lures. Users search for installers, copy commands, share artifacts, and leave long-lived browser sessions open because the tools are part of daily work.
As AI assistants become more embedded, attackers do not need to break the model to profit from the ecosystem around it.
