Anthropic warns infostealer malware is hijacking Claude sessions

What happened

Anthropic has issued warnings to a subset of Claude users alerting them that infostealer malware running on their personal computers has stolen active Claude login sessions, giving attackers unauthorized access to their accounts and the ability to consume their paid usage allotments. The company confirmed the intrusions are not the result of any breach on Anthropic's own infrastructure, but rather compromises that originate on the users' own machines.

This article explains how session-hijacking attacks work in the context of AI platforms, what the theft of a Claude session actually enables an attacker to do, and what developers and teams running Claude-powered workflows should be checking right now. If you use Claude through a browser, a third-party integration, or an API key stored anywhere on a local machine, this situation is relevant to you.

Anthropic began notifying affected Claude users that infostealer malware installed on their computers had exfiltrated active session tokens tied to their Claude accounts. Those tokens were then used by attackers to take over the sessions without needing the account owner's password or any second factor. The result was unauthorized access to live Claude accounts, with attackers able to send prompts, consume monthly or pay-as-you-go usage, and potentially view conversation history. Anthropic's message to affected users was direct: the problem originated on the endpoint, not on Anthropic's servers.

How it works

The company has not publicly disclosed how many accounts were affected or when the earliest incidents occurred. What is clear from the warning is that Anthropic detected anomalous usage patterns or session activity that allowed them to identify the compromised accounts and reach out to those users proactively, which suggests some monitoring capability on the platform side for unusual behavior.

Infostealer malware is a category of credential-harvesting software designed to sweep a compromised machine for authentication material — saved passwords, browser cookies, and session tokens stored on disk or in memory. Once a user logs into Claude through a browser, the session is maintained via a cookie or token that the browser stores locally. If infostealer malware is already running on that machine, it can extract that token and transmit it to an attacker's infrastructure before the session expires. The attacker then imports that token into their own browser or tool, inheriting the authenticated session as if they had logged in legitimately.

Why it matters

This class of attack bypasses multi-factor authentication entirely because the attacker is not logging in — they are resuming an already-authenticated session. The token is valid until it expires or is explicitly revoked. For platforms like Claude that offer high-value compute or rate-limited API access, a stolen session can be rapidly monetized by selling the token to others or by running large automated workloads against the account until the usage is exhausted.

AI platforms represent a new and high-value target for session hijacking because accounts hold both sensitive conversation data and meaningful economic value in the form of compute credits or subscription entitlements. A stolen Claude session is not just a privacy exposure — it is a resource that can be drained. For users on usage-based billing, an attacker running automated prompts against a hijacked session could generate unexpected charges. For users on subscription tiers, usage caps can be hit, leaving the legitimate account holder unable to work until the billing period resets.

This incident also illustrates a supply-chain-adjacent risk: developers who build Claude-powered applications often have Claude credentials or session tokens on the same machines where they manage codebases, API keys, and deployment secrets. A single infostealer infection on a developer machine can therefore expose not just the developer's personal Claude account but potentially any credentials stored in browser profiles, dotfiles, or environment files on that same machine.

Who is affected

Any Claude user who accessed their account through a browser on a machine that was or is infected with infostealer malware is potentially affected. This includes individual subscribers, developers experimenting with the API through a browser-based console, and team members at organizations that allow Claude access on personal or insufficiently managed devices. Users who access Claude exclusively through hardened, centrally managed corporate endpoints with endpoint detection and response tooling in place carry lower risk, though they are not immune if that tooling missed the infection.

Organizations that provision Claude API keys and store them in local development environments rather than secret managers face compounded risk, since infostealer malware routinely targets dotenv files and shell history in addition to browser session storage.

What to watch next

Users who received a warning from Anthropic should immediately revoke all active sessions through their account settings, rotate any API keys associated with the account, and run a thorough malware scan on any machine used to access Claude. Even users who have not received a warning but suspect endpoint compromise should treat their session tokens as expired and force a fresh login. Checking recent conversation history and API usage logs for unfamiliar activity is a practical first step.

On the platform side, the development to watch is whether Anthropic introduces more granular session controls, such as per-device session binding, anomaly-based session revocation, or usage alerts that notify account holders when consumption spikes unexpectedly. Builders relying on Claude for production workflows should treat this as a prompt to audit where credentials live, enforce least-privilege API key scoping, and confirm that endpoint security tooling on developer machines is current.