Back Securityweek Anthropic Warns Claude Users of Infostealer Malware Infections
Anthropic has warned some Claude users that infostealer malware on their computers allowed attackers to hijack login sessions and run up usage limits, according to an email the company sent to affected customers.
The company said it detected the activity, signed out the compromised sessions, and removed saved payment methods from affected accounts as a precaution.
Anthropic is alerting Claude AI users whose computers were infected with infostealer malware such as Vidar, Lumma, StealC, RedLine, and Acreed on Windows, along with Atomic Stealer (AMOS) on a small number of macOS devices.
The AI giant emphasized that the malware is general-purpose and not tied to Claude itself, typically arriving via unofficial downloads or malicious apps.
The company said the malware quietly copies saved passwords, browser login cookies, and credentials for other local applications.
Anthropic believes a threat actor subsequently began selecting the stolen Claude sessions out of that harvested data and using them to access accounts. Users who saw their usage limits appear to refill and then drain without actively using Claude were told this was the likely cause.
In response to the campaign, Anthropic signed out the affected sessions and warned it may sign users out again if it observes further signs of account misuse.
The company also said it removed saved payment methods so accounts could not be charged, and users must add a payment method again to renew or make further purchases. Anthropic also noted that it refunded any Claude charges it identified as unauthorized.
Victims of this campaign have been told to only re-add a payment method after ensuring that all malware has been removed from their computers.
Related : Irregular Details How a Naming Error Let AI Models Attack a Real Company
Related : Judge Says Pentagon’s Measures Against Anthropic Were ‘Illegal and Baseless’
Related : Conflicting Test Goals Pushed Claude Agents to Deploy Self-Replicating Malware
Artificial Intelligence
What the Hugging Face Incident Teaches Security Leaders AI Agent Access
Security teams must treat autonomous agents as highly privileged identities.
Artificial Intelligence
Judge Says Pentagon’s Measures Against Anthropic Were ‘Illegal and Baseless’
The ruling is part of Anthropic's legal battle against the Pentagon after the government labeled the company as a supply chain risk earlier this...
Artificial Intelligence
OpenAI Agents Exploited Linux Kernel Flaw on Company’s Own Systems
CISA has added the exploited flaw, CVE-2026-53362, to its KEV catalog, alongside a JFrog vulnerability exploited by OpenAI agents.
Artificial Intelligence
Tech, Cybersecurity Giants Unite Behind OpenAI-Led Cyber Defense Pledge
Nearly 130 tech and cybersecurity companies back a collective call to boost cyber defenses as AI-enabled attacks grow more sophisticated.
Artificial Intelligence
Think You’ve Eliminated Chinese AI? Check the Model’s Lineage, Cisco Says
New research shows that country-of-origin labels can obscure an AI model’s upstream dependencies, inherited behaviors and potential security risks.
Artificial Intelligence
OpenAI Agents Coordinated via Makeshift Message Board Ahead of Hugging Face Hack
New training environments will teach AI models to distrust instructions arriving from other agents outside sanctioned channels.
Artificial Intelligence
The Future of AI-Driven Security Depends on Complete Data
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
Artificial Intelligence
AI Speeds Up Malware Development, Not Its Success Rate: Analysis
Palo Alto Networks Unit 42 analyzed 405 AI-linked malware samples and found only 12 reached production endpoints.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
