Anthropic automatically signs out Claude users to protect them from hackers

Infostealer malware apparently had harvested active Claude login sessions from users' PCs.

Cheng Xin/Getty Images

Anthropic has been signing users out of their accounts, deleting saved payment cards and refunding charges after attackers used stolen browser data to burn through victims' usage limits. That's according to an email the company sent to affected users last week, which has since been shared publicly on Reddit.

As reported by SecurityWeek, the AI giant points to customers' own computers rather than any breach at Anthropic, telling affected users that infostealer malware had harvested active Claude login sessions from their own PCs. Once inside affected accounts, the attacker(s) could burn through usage limits and make unauthorized Claude charges. "If your usage limits looked like they refilled and then drained while you weren't using Claude, this was likely the cause," the email reads.

In response, Anthropic said it forced sign-outs of affected sessions, removed the card on file and refunded any extra usage charges it tied to the activity. While this stops the stolen sessions, Anthropic told affected users that this doesn't remove the malware.

Both Windows and macOS users are affected

Anthropic has identified six malware families as responsible for the hijacked sessions so far: Vidar, Lumma, StealC, RedLine, Acreed on Windows and Atomic Stealer (AMOS) "on a small number of Macs." None of these infostealers has been built to target Claude specifically; they're general-purpose stealers that usually come bundled with malicious downloads. Once running, they scoop up saved passwords and browser cookies, which then allows threat actors to hijack accounts.

In this case, the infostealers copied Claude session cookies, the tokens that a browser keeps after login so Claude doesn't demand a password on each new page load. An attacker replaying a stolen cookie then picks up the victim's session mid-stream, already authenticated, so password and two-factor authentication requests aren't triggered.

Anthropic's recommended fix is to remove the malware before logging back in to Claude, then lock down the email address attached to the account with a new password and two-factor authentication. Only then, Anthropic says, should payment methods be re-added to affected Claude accounts.

What makes a Claude account worth hijacking?

Stolen Claude logins have serious resale value at scale. Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, told Axios in August that a trade has grown up around hijacked AI accounts, with criminals trafficking credentials for Claude, ChatGPT and Gemini. Meanwhile, findings by Palo Alto Networks' Unit 42 have traced hijacked accounts to proxy services known as transfer stations. These pool stolen credentials and resell access to AI services at a much lower cost than retail.

Anthropic doesn't publish exact figures for its Claude usage limits, but every prompt has a compute cost, which the company absorbs when a stolen session is doing the prompting. An attacker that has hijacked a session with a card on file can also buy extra usage on the victim's account, which is why Anthropic deleted saved payment methods instead of only terminating sessions. The company doubled Claude Code rate limits for paid users in May because demand kept outrunning capacity.

Anthropic can invalidate every stolen session it finds and cover every fraudulent charge, but until the infostealer is gone from a customer's machine, the next login produces a fresh cookie for the same attacker to collect.

We've reached out to Anthropic for comment on this story but did not receive a response. We'll update if we do hear anything.