Anthropic shuts down Claude accounts stolen by infostealers: the flaw isn't in the AI, it's in your PC

By Tech My Money · September 4, 2026.

Anthropic has begun emailing Claude users one by one to tell them their accounts were accessed by third parties after "infostealer" malware stole their session cookies —the file that proves to a service that a user has already logged in— directly from their own computers. According to the outlet Tech My Money, Anthropic closed the stolen sessions, removed the payment method saved on the affected accounts and refunded the charges generated by that misuse.

The nuance matters: there is no breach in Anthropic's infrastructure. The company is explicit that it has no evidence the malware arrived through Claude, or that it is related to anything the user did inside the app. The origin lies in the users' own machines, almost all of them on Windows and a small number on Mac. Anthropic names the malware families detected: Vidar, Lumma (also known as LummaC2), StealC, RedLine and Acreed on Windows, and Atomic Stealer (AMOS) on Mac. These are generic credential-stealing tools that usually slip in through a pirated download or a fake app, and that vacuum up anything of value they find in the browser: saved passwords, card details and, also, active session cookies. The Claude account was just one more item on the list.

That is the technical part worth understanding properly. A session cookie is not a password: it is already-validated proof that someone has cleared the login. If an attacker copies it and replays it in their own browser, they get straight in, without triggering either a password prompt or two-factor authentication (2FA), because that step was already completed when the victim logged in legitimately. According to Anthropic's notice, the signal that gave away many of the cases was precisely that: Claude usage limits filling up and emptying on their own while the account holder was not using the service.

Anthropic's response has a limit that the company itself acknowledges without hedging: closing the session stops the abuse, but it does not remove the malware from the computer. If the machine remains infected, a fresh legitimate login can generate a cookie just as stealable as the previous one. That is why the email asks users, in this order, to clean the machine, change the password and enable 2FA on the email address linked to the Claude account, and only then to add a payment method again. Anthropic also warns that it may repeat the forced sign-out if a similar pattern of abuse reappears. What it has not done, to date, is publish a public notice in its newsroom or provide a figure for the number of affected accounts: everything that is known comes from the individual emails and from the documentation already available in its Help Center, where Settings > Account lets users view active sessions (device, browser, approximate location, last activity) and close them all at once; web sessions, that documentation notes, expire after 28 days of inactivity and renew every hour while there is active use.

As sector context, this is not a vulnerability exclusive to Claude. The malware-as-a-service business —infostealers rented or sold on underground forums for a monthly fee— has been targeting Steam, Discord, online banking and cryptocurrency wallet accounts for years. That it now adds Claude and, as the article itself mentions, equivalent mechanisms in ChatGPT (OpenAI's Lockdown Mode) is no coincidence: a paid AI account is worth real money, in credits, usage limits and the card attached to it, and that makes it as legitimate a target for generic cybercrime as any other account with a balance.

That, for us, is the underlying reading. Session theft says nothing bad about the security of Anthropic's models; it says something about a design tension shared across the entire software-as-a-service industry. The less friction placed on the login —persistent sessions, long-lived tokens, so the user does not have to re-authenticate constantly— the more valuable that token becomes to an attacker, and two-factor authentication stops being any use at all once the session is live. In the short term, this translates into real friction for ordinary users: sign-outs with no advance warning, cleaning the machine, redoing credentials. It is the toll, uncomfortable but manageable, of AI use now moving real money.

In the medium term, the episode also points to why digital identity —passkeys, hardware-bound tokens, continuous rather than one-off verification— is going to become an infrastructure priority as important as the model itself. If the direction of the sector is for AI agents to act increasingly autonomously with our credentials and cards —purchases, bookings, administrative tasks— robust identity stops being a security extra and becomes the foundation without which that promise of useful autonomy, and ultimately of abundance, does not hold: nobody delegates critical tasks to an agent if the account authorizing it can be blown open by a stolen cookie. What is least convincing about Anthropic's handling of this episode is precisely the opacity: private notices, with no public figure or open statement. If AI accounts are becoming a target for an already industrialized cybercrime business, transparency about the scope should be as standard as the patch itself.