Claude Session Theft: How to Protect Your AI Account

The Lock Was Fine. The Window Was Open.

Anthropic has begun notifying Claude users whose active login sessions were stolen by infostealer malware running on their own computers. Attackers used those sessions to sign in and burn through the victims' usage allowances. BleepingComputer reported the notifications on August 30, 2026, with SecurityWeek and Help Net Security covering them the following day.

The important detail, and Anthropic stated it plainly: this has nothing to do with Claude itself. No Claude system was breached. The malware was already on the machine, and it took the session token the way it takes everything else.

• Session cookies were stolen from infected machines, letting attackers bypass both password and two-factor prompts
• Malware families named include Vidar, LummaC2, StealC, RedLine and Acreed on Windows, plus Atomic Stealer on a small number of Macs
• Anthropic's response: signing affected users out, removing saved payment methods, and refunding charges identified as unauthorized
• The tell: usage limits that appeared to refill and then drain while you were not using Claude

Why Two-Factor Authentication Did Not Help

This is the part worth internalising, because it applies to every account you own, not just this one.

Two-factor authentication protects the act of logging in. Once you have logged in, the service hands your browser a session cookie that says "this person already proved who they are." Every subsequent request rides on that cookie. Steal the cookie and you skip the login entirely — no password, no code, no prompt.

Infostealers are built precisely for this. They arrive through a cracked download or a malicious app, sweep everything the browser has stored locally — saved passwords, cookies, credentials belonging to other applications — and ship it off in one batch. The Claude session was not targeted. It was in the pile.

What Should You Actually Do?

Anthropic's guidance is short, and the order matters:

• Remove the malware first. Full antivirus or anti-malware scan on the affected machine. Anthropic was explicit that signing you out stops the current stolen session but does nothing about the infection — if it is still running, your next login gets taken the same way.
• Then change credentials. Password reset on Claude and on anything else that shared the browser profile. Email first, since it is the recovery path for everything else.
• Then revoke other sessions. Most services have a "sign out everywhere" control. Use it after the malware is gone, not before.
• Check your billing. Anthropic is refunding charges it identifies as unauthorized, but you know your own usage pattern better than any detection system does.

How Do You Stop This Happening Again?

The honest answer is that endpoint hygiene does most of the work, and it is not exciting. Do not run cracked software. Be suspicious of installers from search ads. Keep the browser and the operating system patched, because infostealers frequently ride in on something else.

The more durable fix is architectural, and the industry is already moving on it. Device-bound session credentials tie a session cookie cryptographically to the machine that created it, so a stolen cookie is useless anywhere else. We covered Google shipping device-bound cookies to stop exactly this class of hijack earlier this year, and it is the right direction for every AI provider to follow.

Credit where it is due: proactively signing users out, stripping saved payment methods and refunding unauthorized charges is a good response to an incident that did not originate on your own systems. That is the behaviour you want from a vendor.

For readers running their own stack, the same principle applies one layer down — our self-hosted LLM server security guide covers session and credential handling, and the rest of our AI security coverage tracks how agent and account access controls keep evolving.

Sources: BleepingComputer — August 30, 2026; SecurityWeek — August 31, 2026; Help Net Security — August 31, 2026.