DIGGINGBEAGLE
Home/cases

Case · DiggingBeagle record

Infostealer malware stole active Claude sessions from users

Anthropic warned affected Claude users that commodity infostealer malware on their own devices had stolen active login sessions, enabling unauthorized Claude use and consumption of account limits. Anthropic invalidated sessions and removed stored payment methods as a precaution. This was endpoint/session theft, not a breach of Anthropic's infrastructure.

First seen
Aug 30, 2026
Case kind
incident
AI role
AGAINST AI
Claims
6

Reconstruction

Claims & evidence

reported findingsupported

SecurityWeek reports that Anthropic notified users whose active Claude sessions had been stolen by infostealer malware.

reported findingsupported

Anthropic linked affected Windows devices to infostealers including Vidar, Lumma, StealC, RedLine and Acreed, and a smaller number of macOS devices to Atomic Stealer.

reported findingsupported

The reported compromise originated from malware on customer endpoints rather than a breach of Anthropic's own systems.

reported findingsupported

Anthropic signed out compromised sessions and removed saved payment methods from affected accounts as a precaution.

reported findingcontested

The reporting does not describe a breach of Anthropic's service; the initial compromise was malware on user systems.

Implications

What remains unknown

  • The number of affected users and total unauthorized usage were not disclosed in the cited report.

Cite this record

DiggingBeagle. “Infostealer malware stole active Claude sessions from users.” First seen Aug 30, 2026. https://diggingbeagle.com/cases/infostealer-malware-stole-active-claude-sessions-from-users/

Citation guidance

Why this archive exists

The source matters after the headline fades.

DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.

We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.