Stolen Claude session cookies can reach corporate Gmail through
Infostealers replayed stolen Claude session cookies into paid accounts without ever touching the login page two-factor authentication guards.
By Dillip Chowdary • Sep 02, 2026 • Source: VentureBeat
What happened
Security researchers have discovered that infostealer malware is bypassing standard corporate defenses by stealing Claude session cookies. Attackers can replay these active cookies to gain unauthorized access to paid Anthropic accounts without triggering two-factor authentication on login pages. Because these self-serve accounts operate outside central corporate identity providers, administrators cannot revoke these active sessions.
How it works
Advertisement
Tech Pulse Daily
Get tomorrow's pulse first
Join engineers who read Tech Pulse before stand-up. Free, weekday mornings.
This article examines how session-cookie replay bypasses single sign-on security, details the risks of un
Why it matters
Read the original coverage at VentureBeat via the source link above for the complete details and primary quotes.
Who is affected
Cross-check release notes and official docs before changing production systems based on early reporting.
Developer Action Items
- ☐ Diff the official changelog for Anthropic / Claude before you bump — APIs, defaults, and removed flags only.
- ☐ Install through the vendor's documented channel in staging; keep a one-command rollback and time-box the canary.
- ☐ Grep your repo for old flag names, lockfile pins, and plugin versions that the notes mark as breaking.
- ☐ Prefer the first patch cut over the day-zero tag unless you have a reason to be on the leading edge.
- ☐ If VentureBeat did not name a region, plan, or SKU, screenshot the official availability line before you promise it to users.
Author
Dillip Chowdary
Writes Tech Bytes coverage of AI, engineering, and the tools that actually ship. Editor of Tech Pulse Daily.
Related on Tech Bytes
Advertisement