Anthropic warns: infostealers are stealing active Claude sessions

Imagine opening Claude in the morning and finding that your usage limit has practically vanished. You weren't working, no one on your team recognizes that usage, and your password is still the same.

That's basically what started showing up in some Claude accounts.

In late August, Anthropic began sending notices to affected users after detecting that an actor was using legitimate Claude sessions obtained through infostealers installed on victims' computers.

And here's the important detail: so far, Anthropic has not published a specific public advisory about this incident. The information comes from emails sent to affected users and later documented by specialized outlets such as BleepingComputer and Malwarebytes.

Claude was not compromised

This part is worth making very clear.

The available evidence does not point to a vulnerability in Claude or an intrusion into Anthropic's infrastructure.

According to the notice sent by the company, users' machines were already infected with malware designed to steal information.

Anthropic identified five known families on Windows:

• Vidar
• LummaC2
• StealC
• RedLine
• Acreed

On a smaller number of Mac machines, Atomic Stealer, also known as AMOS, appeared.

These are general-purpose infostealers. Claude simply ended up being just another one of the accounts available within the information collected by the malware.

The problem is in the session

When we log in, we normally think of three things: username, password, and, if we do things right, MFA.

But after we authenticate, the browser needs some way to remember that we already proved who we are.

To do that, it keeps session information.

We can think of it as the wristband you're given when you enter an event. You showed your ticket at the entrance and they verified your identity. From that point on, the wristband proves you already passed the checkpoint.

If someone manages to copy a valid equivalent of that digital wristband, the problem changes.

The attacker can reuse a session that was already authenticated.

That's why this attack is especially interesting from a security standpoint: the criminal doesn't necessarily need to know the password or obtain the MFA code.

The MFA control worked. It simply happened before the theft.

What Anthropic found

Reports published so far indicate that infostealers copied active sessions from infected machines and that an actor later began using them to access the accounts.

Anthropic detected the activity and took several measures on the affected accounts:

But there was another, far more interesting clue.

Anthropic warned some users that if their limits appeared to reset and then ran out again while they were not using Claude, that activity was probably related to the incident.

That turns a metric we would normally consider financial into a possible security signal.

AI usage can also be telemetry

This is the part of the case that interests me most.

For years we have monitored access attempts, strange locations, password changes, network activity, and the execution of suspicious processes.

Now we have another metric that is starting to make sense to monitor: the usage of our AI platforms.

If a company normally consumes a relatively stable amount of credits and suddenly requests appear outside business hours or increases that are hard to explain, there may be a perfectly legitimate reason.

But it also deserves investigation.

Especially when AI tools start handling corporate information, repositories, documents, and connections to other services.

Claude may be just the first clue

An infostealer typically does not reach a computer looking exclusively for Claude.

Its business consists precisely of collecting everything that can be exploited.

That completely changes how I would respond to an incident of this type.

If I discover that a Claude session was stolen from a computer, I would not assume that Claude is the only compromised account.

I would review the other sessions and credentials used from that machine: corporate email, Microsoft 365, Google Workspace, GitHub, cloud services, CRM, and any administrative panel used regularly.

The reasoning is simple: if the malware had enough access to the machine to obtain a session, we must investigate what else it could have collected.

Closing Claude does not clean the computer

This point can also create a false sense of security.

Anthropic can invalidate the stolen session and cut off the attacker's access to that specific session.

That doesn't remove the malware from the endpoint.

If you log back in immediately from the same compromised computer, you could generate new credentials or sessions that end up exposed again.

That's why the order of response matters.

What I would do about usage I don't recognize

First, I would investigate the device and run a full scan with the security tools available in the organization.

Then I would invalidate active sessions for the services used from that machine and review recent access.

Passwords should be changed from a trusted device once the infection has been addressed, starting with the accounts that could be used to recover other accounts, especially email.

I would also review payment methods and recent transactions.

In an organization, I would add one more task: compare the historical usage of AI platforms to find spikes, after-hours activity, or patterns that don't match the team's normal behavior.

MFA is still necessary

This incident doesn't mean MFA has stopped working either.

It protects against a huge number of credential-related attacks and remains a basic measure we should be using.

What this case shows is that MFA can't protect a compromised endpoint on its own.

Once the malware is operating inside the computer with enough access to the user's context, the security boundary has moved.

You can have an excellent lock on the door. If someone is already inside the house copying the keys you use, you have another problem.

What I take away

For a long time we treated AI accounts as relatively isolated tools.

That's starting to make less and less sense.

Claude, ChatGPT, Copilot, and other services are already part of the daily development environment and of many business operations. They have sessions, permissions, information, and increasingly, connections to other systems.

That's why they should also show up in our monitoring processes.

And there's one concrete idea I take from this incident: unexplained AI credit usage can be a security signal.

It doesn't prove by itself that malware exists. But it can justify an investigation.

Conclusion

The Claude case is interesting precisely because it didn't require a spectacular vulnerability.

The weak point was compromised computers and something as everyday as a session we leave open.

Anthropic was able to detect the abuse, close sessions, remove payment methods, and address the charges identified. For a company, the lesson should go a bit further.

If a session used from an endpoint appears compromised, you need to investigate the entire endpoint and the other services used from it.

And if we're already measuring how much AI costs within the organization, it's worth starting to use that same information for security.

That unexplained spike in credits might be a strange invoice.

Or it might be the first clue we have.