Anthropic wipes saved cards after infostealers copy Claude login sessions

Anthropic's email to affected customers says the giveaway was a usage limit that appeared to refill and then drain while the owner had not opened Claude at all ^[4]. For one person on one account, that is a workable signal. Spread across a team's seats, the person who notices a curve like that is whoever owns the curve, and on most teams nobody owns it.

What got taken was a cookie. A session is proof that you already signed in, it sits on the machine, and whoever copies it never runs the login again, so the password prompt and the second factor are never reached ^[9]. Anthropic says the same malware also collects saved passwords and credentials belonging to other apps running locally, and the Claude session was one item among many that it picked up ^[10]. The email is public only because a recipient posted it in the r/ClaudeAI forum ^[2].

Both of Anthropic's steps sit on Anthropic's side of the boundary. The sign-out cancels the stolen session everywhere, which is why affected users had to log in again on all of their own devices ^[12]. The card deletion means Claude can no longer charge that payment method, while the plan already paid for runs to the end of the billing period ^[13]. The line in the email that matters most for anyone doing cleanup is the one about reach: "Signing you out stops the stolen sessions, but it doesn't remove the malware" ^[15]. One recipient pointed Claude Opus at his own machine to find and shut the malware down, and a commenter who said he had twenty years in security recommended wiping the system and resetting every password, because this class of malware routinely drops copies that restore it ^[16].

The named families say something about who is exposed. Anthropic lists five stealers on Windows plus Atomic Stealer on a small number of Macs, six families across two operating systems ^[6][17], and says the software typically arrives with an unofficial download or a malicious app rather than through Claude ^[7]. Phones and tablets do not appear to have been involved ^[8]. One affected user had installed a pirated game, and Windows Defender did not react ^[11]. The exposed surface is a personal laptop with a browser profile on it.

Login protects the spend, or so the comfortable account of AI account security goes. Here, the login was completed once by the legitimate user, then copied and spent by someone else ^[1].

Two axes are worth drawing over your own paid seats. First, where the first signal comes from: a vendor email, or your own usage and billing telemetry. Second, how far remediation reaches: the vendor can revoke a session and detach a card ^[3], and cannot touch the machine the cookie came from ^[15]. The bad cell is vendor-email detection paired with account-only remediation, which is where the affected accounts sat, and the only cell you can move yourself is the first one.

That leaves the money. BleepingComputer reports that Anthropic is also refunding charges it identifies as unauthorized ^[18]. The verb carrying the weight there is "identifies": a team with its own record of what was consumed and when has something to bring to that conversation, and a team without one accepts the vendor's arithmetic.