On 30 August 2026 Anthropic began notifying Claude users whose active sessions had been stolen by infostealer malware running on their own computers. No password was cracked and no second factor was defeated. The asset being stolen is metered inference, which now has a resale market, and that is what moved AI subscriptions into the same malware kits as banking and crypto credentials.
On 30 August 2026, Anthropic began contacting Claude users to tell them something uncomfortable: other people had been using their accounts, every active session was being terminated, and the payment cards stored on those accounts had been deleted. Users who had done nothing wrong were signed out with little warning and found their saved cards gone. It read like a breach at Anthropic. It was not one.
The malware was already on the customers' own computers, and what it took was not a password. It took the cookie that proves you already logged in. That single fact rearranges everything about who was at fault, what the vendor could do about it, and what the affected user still has to do today.
According to BleepingComputer and Help Net Security, which both carried the story on 31 August, the compromise occurred on user machines rather than on Anthropic infrastructure. Infostealer malware — commodity software whose entire job is to sweep a machine for anything sellable — copied active login session cookies. With those cookies, attackers reached the accounts and burned through paid usage quota. No password was needed and no second factor was defeated.
The malware families named in the reporting are not exotic. BleepingComputer lists Vidar, LummaC2, StealC, RedLine and Acreed on Windows, plus Atomic Stealer on a smaller number of Macs. These are the same kits that have been harvesting banking logins and crypto wallet files for years. Nothing about them was built for this. They simply added another file path to the collection list.
Anthropic's response was to force a sign-out of all active sessions, revoke the stolen tokens, delete stored credit cards on affected accounts, and refund unauthorised charges. Help Net Security reports that the anomaly was surfaced by unusual usage patterns rather than by any report from the users themselves — which is worth sitting with, because it means the accountholders had no way of knowing.
No affected-user count has been disclosed. Anthropic has not published one, and no reporting has established one. Any number you see circulating is an estimate.
Most people carry a mental model of authentication in which the password is the door and two-factor authentication is the deadbolt. That model is roughly correct, and it is also why this attack is so widely misunderstood — because the attacker never approached the door.
Here is the actual sequence. When you log in to a web service, you present your password and, if enabled, your second factor. The server checks both, decides you are who you claim to be, and then issues a session token — a string of characters stored in your browser as a cookie. Every subsequent request you make carries that cookie, and the server treats it as proof that the authentication already happened. It does not re-ask for the password on every page load, because that would be unusable.
The session cookie is therefore not a key to the lock. It is a receipt saying the lock was already opened. An attacker holding that receipt does not need to defeat the password or the second factor, because from the server's point of view those checks are in the past and already passed. Changing your password does not invalidate it. Enabling two-factor authentication does not invalidate it. Both of those controls govern the act of logging in, and the attacker is not logging in.
This is why the vendor's only meaningful lever is server-side revocation: forcibly invalidating every issued token so that the receipts stop being honoured. There is no client-side control the user could have enabled that would have prevented it, short of not being infected. That is an unsatisfying answer, and it is the correct one.
Deleting stored payment methods looks like an overreaction until you follow the same logic. A live session is an authenticated session. If the account interface lets an authenticated user spend against a stored card, then whoever holds the session can spend against it too. Removing the card removes the spending capability from the session — which is why it was done to accounts belonging to people who had done nothing wrong.
Infostealer operators are not ideological. They add a target when it has resale value, and metered inference now does. The stolen asset here is not data and not identity — it is compute the victim has already paid for, which can be resold to someone who wants model access without a bill or an audit trail.
The market for this is documented and it is not small. Infosecurity Magazine has reported roughly 400 daily dark-web listings for stolen generative-AI accounts. Cybernews has described resale operations, concentrated in China, offering Claude API access at up to 90% below official pricing. Historical listings on the defunct LLM Paradise market advertised stolen GPT-4 and Claude API keys for as little as $15. And one figure frames the trajectory better than the rest: credential theft aimed specifically at AI services grew 376% between the fourth quarter of 2025 and the first quarter of 2026.
Set that against the economics. A stolen banking credential has to be laundered through a payments system that is actively hunting for it, and the window closes fast. A stolen AI session gets resold as discounted API access to buyers who have no incentive to report anything, and it monetises immediately at whatever the victim's plan permits. The unit value is lower than a bank account. The friction is very close to zero. For a commodity stealer kit that already runs on the machine, adding one more cookie path is nearly free — and that is the entire reason this happened.
The consequence for organisations is a classification problem. Most endpoint inventories still treat AI tools as productivity software rather than as credential-bearing assets, in the category occupied by banking portals and password managers. On the evidence of this incident, that classification is wrong.
The most important sentence in this story came from Anthropic itself, and it is a concession. As reported by BleepingComputer, the company stated that signing a user out stops the stolen sessions but does not remove the malware, and advised affected users to run a full scan before logging back in.
“Signing you out of Claude stops the stolen sessions, but it doesn't remove the malware. If it's still on your computer, your next login session could be stolen the same way. — Anthropic, as reported by BleepingComputer”
Vendors do not usually volunteer that their remedy is partial, and the admission deserves credit. It also deserves to be read precisely. Revocation resets the compromise to zero; it does nothing to the cause. A user who logs back in on a machine that is still infected has simply issued the attacker a fresh receipt. The clean-up is on the endpoint, and it belongs to the user — which is an uncomfortable division of labour when the user's first knowledge of the problem was an email telling them their card had been deleted.
There is a fair counter-argument to the criticism of Anthropic's handling, and it should be stated. Given a live compromise of unknown scope, mass revocation is the fastest containment available, and delaying it to write gentler notifications would have extended the window in which attackers were spending customers' money. Speed and communication quality traded against each other here, and the company chose speed. Reasonable people can disagree about the ratio.
Three limits are worth stating plainly, because the story has been repeated with all three blurred. First, this was not a breach of Anthropic, and no reporting has claimed otherwise. Second, no affected-user count exists in public, so the scale is genuinely unknown. Third, nothing here indicates that Anthropic's authentication design is unusual — the session model described above is how essentially every consumer web service works, which means the exposure generalises to every AI subscription you hold, not to this one vendor.
That last point is the durable one. The mechanism has no special affinity for Claude. It found Claude because Claude is worth money, and the same is true of every other metered AI product on the market.
Because they did not need it. When you log in successfully, the service issues your browser a session cookie that acts as proof the login already happened. Infostealer malware copies that cookie off your machine. Anyone holding it is treated by the server as an already-authenticated user, so the password never comes up.
We cover the mechanics behind AI security incidents — agent permissions, connector inheritance and model behaviour — not just the headlines.
Read more in AIClaude Fable 5.1 costs exactly what Fable 5 cost per token. The 25-to-45% saving Anthropic advertises comes from one repriced line item — cached input, now billed at 2.5% of list instead of 10%. That is a discount you only collect if you keep the agent running.
OpenAI's incident report on the Hugging Face breach leads on a security failure. The remarkable part is a verbatim chain-of-thought in which a model identifies its action as unauthorised and proceeds anyway — and an escape route that was a package manager, not a superintelligence.
Three separate events happened this week and coverage is treating them as one. Ninety days of notice for the chat interface, six months for the API snapshots, twelve months for the Assistants API — and no automated migration anywhere.