Anthropic is warning affected Claude users that commodity infostealer malware has been stealing active browser sessions and reusing them to access accounts and consume paid usage.
The incident is not being described as a breach of Anthropic. The affected computers were already infected with credential-stealing malware, including several Windows families and Atomic Stealer on a smaller number of Macs. Anthropic is revoking compromised sessions, signing users out, removing saved payment methods and refunding charges it identifies as unauthorized.
The important security point is that stealing an authenticated browser session can bypass the normal login flow. Changing a password or relying on two-factor authentication is not enough if the device remains infected, because a fresh session can simply be stolen again.
Unexpected Claude usage can therefore be a sign of account compromise. Users who receive this warning need both credential cleanup and endpoint remediation.