What happened with Anthropic and infostealer malware in August 2026?

Anthropic began emailing affected Claude users in late August 2026 to warn that infostealer malware running on their own computers had siphoned active Claude login sessions. Attackers reused those stolen session tokens to sign in as the user and consume their usage limits. Anthropic's response was to force sign-out on affected accounts, remove saved payment methods, and refund charges its investigation determines were unauthorized. The warning reached wider attention after a recipient posted the email on Reddit.

Was Anthropic breached?

No. This was not a compromise of Anthropic's infrastructure. The malware ran on end-user machines and stole browser session cookies locally, which is why Anthropic's remedy targets individual accounts rather than a platform-wide reset. The distinction matters: no password change on Anthropic's side would have prevented it, because the attacker never needed the password.

How do I know if my Claude account was affected?

Anthropic contacted affected users directly by email and forced a sign-out. If you were signed out of Claude unexpectedly in late August 2026 and found saved payment methods removed, you were likely in scope. Check your billing history for usage spikes you cannot account for, and check whether any Claude API keys tied to the account were used from unfamiliar locations.

Does a password reset fix stolen session cookies?

Only if the provider also invalidates existing sessions. A password change alone does not always revoke live session tokens. The reliable fix is an explicit sign-out-everywhere or session-revocation action, followed by removing the malware from the machine. Resetting the password on an still-infected computer simply hands the attacker a fresh session.

Quick Answer

Claude Session Hijacking: Anthropic Infostealer Warning

Published: August 31, 2026

The Short Answer

Infostealer malware on users’ own PCs stole live Claude session cookies. Attackers replayed those tokens to log in as the victim and burn their usage limits.

Anthropic’s response (late August 2026): force sign-out of affected accounts, delete saved payment methods, refund charges identified as unauthorized.

This was not a breach of Anthropic. The theft happened on the endpoint.

Last verified: August 31, 2026.

What Actually Happened

Anthropic started sending targeted warning emails to a subset of Claude users in the last days of August 2026. The message told recipients that Anthropic had detected evidence their machine was compromised by information-stealing malware, and that the malware had captured an active Claude login session.

The attack does not need a password. Modern infostealers — the Lumma/Redline/Vidar family and their many forks — hoover up browser cookie stores, saved credentials, crypto wallets and clipboard contents in a single pass. A live session cookie for claude.ai is as good as being logged in, and it bypasses the password and any multi-factor prompt, because MFA was already satisfied when the session was created.

Attackers used the stolen sessions to consume Claude usage limits. That is the tell: victims noticed their quota draining without corresponding activity. For paid accounts with stored cards, the exposure extended to billing.

The story became public after an affected user published the Anthropic email on Reddit, and was then picked up by BleepingComputer and Search Engine Journal on August 30, 2026.

Anthropic’s Three Remediation Steps

Action	What it fixes	What it doesn’t
Force sign-out	Invalidates the stolen session token	Nothing, if malware is still resident — a new session gets stolen too
Remove saved payment methods	Stops further card charges through the account	Charges already made
Refund unauthorized charges	Financial harm, after investigation	Usage-limit consumption during the window

The sequencing is correct and worth copying if you run a subscription product. Revoking sessions without removing the payment instrument would leave a re-compromised account monetizable. Removing the card without revoking sessions would leave the attacker with read access to conversation history — often the more sensitive asset.

Why AI Accounts Are a Growing Infostealer Target

Three things changed in 2026 that make AI accounts unusually attractive to session thieves:

1. Usage limits are a resellable commodity. A hijacked Claude Max or ChatGPT Pro session is directly monetizable through grey-market “shared account” resellers. This is a materially different incentive from stealing a Netflix cookie.

2. Conversation history is a credential store. Developers paste API keys, connection strings, internal hostnames and unreleased code into chat windows. A stolen session is often a faster path to production secrets than the production systems themselves.

3. Long-lived sessions are the norm. AI chat products deliberately keep users signed in for weeks because re-authentication kills the habit loop. That convenience choice widens the window a stolen cookie stays valid.

The related risk vector — agentic products that hold filesystem and browser access — is covered separately in our agent security controls comparison.

What To Do If You Were Affected

Clean the machine first. Anything you do before removing the malware is wasted. Run a reputable scanner, and for a confirmed infostealer hit, treat rebuild as the default rather than the fallback.
Revoke sessions everywhere, not just Claude. The same cookie sweep took your Google, GitHub, Slack and email sessions. Use each provider’s “sign out of all devices” control.
Rotate every API key that lives in a browser-accessible place. Anthropic console keys, OpenAI keys, GitHub PATs, cloud credentials.
Re-enroll MFA. Session theft defeats MFA at login time; re-enrolling ensures no attacker-added authenticator persists.
Check billing on every subscription, not only the one you were warned about.

The Structural Lesson

Session-token theft is the dominant account-takeover method in 2026 precisely because the industry succeeded at password hygiene and MFA adoption. Attackers moved past the front door to the thing that sits behind it.

For providers, the durable mitigation is device-bound session tokens — binding a session to a hardware key so a copied cookie is useless on another machine. The web standard for this (DPoP-style proof-of-possession, and token binding at the TLS layer) exists but adoption across consumer AI products remains thin as of August 2026. Until it lands, “sign out of everything” remains a manual chore users perform only after they have already been robbed.