Anthropic has confirmed that malware infections are letting attackers steal active login sessions for Claude, its AI chatbot, and use those sessions to run up usage on someone else's account. The company disclosed the issue as a security warning, not a data breach announcement — but for anyone paying for Claude access, the distinction matters less than the bill.
The mechanism here is called session hijacking, and it works differently than a typical password leak. Infostealer malware — a category of malicious software that has been circulating for years — quietly copies data stored in a victim's web browser, including session tokens: small pieces of code that prove you're already logged in. Once an attacker has that token, they can access the account without ever knowing the password, and critically, without triggering multi-factor authentication, because as far as the system is concerned, the session is already authenticated.
This isn't a new attack technique. Infostealers such as those known in security circles as Redline, Vidar, and Lumma have been harvesting browser cookies and session data for years, historically targeting banking logins, cryptocurrency wallets, and social media accounts. What's changed is the target list. AI accounts are now valuable enough — because usage is metered, tied to paid subscriptions, or connected to API billing — that stolen sessions are being resold or exploited for their own sake, not just as a stepping stone to something else.
Anthropic's warning follows a broader pattern across the AI industry. Reports over the past year have documented stolen ChatGPT and other AI service credentials circulating on dark web marketplaces, often bundled with other harvested account data. The AI companies themselves are rarely the ones breached; the theft happens on the user's device, through malware that got there via a fake download, malicious browser extension, or phishing link, then quietly exfiltrates whatever session data it finds.
The pattern that tends to follow this kind of disclosure is fairly consistent: the company issues guidance on securing accounts, security researchers publish more detail on the specific malware strains involved, and enterprise customers start asking for stronger session controls — shorter session lifespans, device binding, or mandatory re-authentication for sensitive actions. Full account lockdowns or forced password resets across the board are less common unless the scale of theft is large.
For small businesses, the practical exposure depends on how Claude or similar AI tools are used. A business running API-connected workflows — customer service bots, content pipelines, internal tools — faces a different risk than someone using the chat interface occasionally. Stolen sessions on API-connected accounts can rack up usage charges quickly, since API billing is often per-token and uncapped by default unless spending limits are set.
The most immediate, low-effort defense is checking whether spending or usage limits are configured on any AI accounts tied to a business credit card, and reviewing billing history for unfamiliar usage spikes. Beyond that, standard endpoint hygiene matters more than it usually gets credit for: keeping antivirus and browser extensions minimal and reputable, since infostealers frequently arrive disguised as browser add-ons or cracked software. Businesses using shared or personal devices for company AI accounts are at higher risk simply because those machines see more varied, less controlled software.
Watch for whether Anthropic or competitors introduce shorter default session lengths, mandatory re-login for billing changes, or device-based session alerts — features that other cloud services adopted only after similar incidents forced the issue. Also worth tracking: whether stolen Claude sessions start showing up for sale on the same dark web forums already known for trading ChatGPT and cloud service credentials, which would confirm this has moved from isolated incidents to a running market.
The bottom line: this is a malware problem wearing an AI-company label, not a flaw in Claude itself. Businesses relying on AI tools should treat account access with the same seriousness as banking logins — because to an attacker, the two now look increasingly alike.