Anthropic emailed Claude users on August 30 to say a bad actor is using commodity infostealer malware to take over their sessions and burn their usage — and as of this writing that notice exists only as an email, with nothing on the company’s newsroom or status page.
What happened
On Sunday, August 30, 2026, a Claude user posted to Reddit the text of an email they had received from Anthropic. BleepingComputer and Search Engine Journal both reported the notice the same day, reproducing the same passages. Severity Daily has not received the email and cannot authenticate it directly; what follows is what those outlets published, labeled as such throughout.
The notice, as reproduced, opens: “We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers, then using those login sessions to access Claude accounts and consume their usage.” It goes on to tell the recipient what has already been done to their account: “We recently signed you out of Claude and removed the payment method saved on your account.”
Anthropic names the malware families involved. On Windows: Vidar, LummaC2, StealC, RedLine, and Acreed. On macOS: Atomic Stealer, commonly abbreviated AMOS, which the notice describes as affecting a small number of devices. Every one of those is a commodity infostealer sold or rented to whoever wants it. None is novel, and none is specific to Anthropic.
The notice is also explicit about where the malware came from, and the wording is worth reading exactly: “We have no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude.” Per the reporting, Anthropic says it is signing affected users out, removing saved payment methods, and refunding charges the account holder did not authorize.
What does not exist is a public version of any of this. Severity Daily checked Anthropic’s newsroom, which carries nothing dated August 28, 29, or 30, 2026 and nothing on account security, session theft, or infostealer activity. The company’s status page carries no incident or notice for those dates either. There is no security bulletin, no help-center article that the reporting points to, and no statement given to either outlet beyond the email text itself. Anthropic has not disputed the notice’s authenticity, and it has not confirmed it.
Two things are therefore unresolved and should stay that way on this page. First, scale: nobody outside Anthropic knows how many accounts received this email. Second, timing: the notice says “recently” and gives no date for when the activity began, when it was detected, or over what window usage was consumed.
Why it matters
Start with the mechanism, because it is the part that generalizes past Claude. A session token is a bearer credential. Whoever holds it is the user, and the checks that ran at login — password, one-time code, hardware key, device trust — already ran and already passed. Stealing the token after the fact skips all of them. This is why “we require MFA” is not an answer to infostealer malware, and it is why the standard advice to rotate a password does very little on its own. The password was never the thing that was taken.
Infostealers have been harvesting browser cookie jars for years; that is their core function, alongside saved passwords, autofill data, and crypto wallets. What is new in this notice is the destination. The stolen sessions are not being resold for the account’s contents or used to pivot into an employer’s systems. They are being used, in Anthropic’s own phrasing, to “consume their usage.” Somebody built a business on stealing metered AI capacity.
That is a distinct abuse economy and it deserves a name in defenders’ threat models. Paid AI accounts are, functionally, prepaid compute with a generous rate limit and no per-request billing signal to the user. A stolen session yields inference capacity that can be resold, wrapped in a proxy, or spent on the buyer’s own workloads, and the victim’s first symptom is not a fraudulent charge but a limit that runs out early. Fraud detection built to catch a suspicious payment will not see it. Nor will most people notice: hitting a usage cap looks like ordinary heavy use.
The payment-method detail is the part that should give security teams pause. Anthropic did not merely invalidate sessions; it removed saved payment methods and is refunding charges. That is a reasonable precaution, but it also tells you the blast radius of an authenticated web session extends into billing. Any organization whose staff hold individual paid accounts on any SaaS product — not just this one — should assume the same shape: a stolen session is a stolen card-on-file, at least for the purpose of buying more of the service.
Then there is the disclosure question, which is the reason this story sits under Developing rather than being written as settled fact. Notifying affected users directly is the right first move and Anthropic appears to have made it. But a notice that exists only in individual inboxes has predictable failure modes. Security teams cannot act on what they have not seen; an employee who receives a “your session was stolen” email from a vendor has no way to distinguish it from the phishing lure that email is shaped exactly like; and the people best positioned to hunt for Vidar or Acreed across a fleet are not the ones who got the email. A short public post naming the malware families and the indicators would cost the company very little and would let every affected organization run the search on its own.
It is also, in a narrower sense, a record problem. The only durable artifact of this event right now is a screenshot on a social platform, mediated by two publications. If Anthropic later revises what it knows — a larger number, a longer window, a different set of families — there is nothing to revise. This is how incidents become unciteable a year later.
What to do
If your organization uses Claude, or any paid AI service, treat this as an infostealer problem rather than a vendor problem, because that is what the notice says it is. The compromise happened on endpoints.
Hunt for the named families on managed devices: Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer on macOS. All six are well covered by public detection content, and all six exfiltrate browser cookie databases early in their run, so the window between infection and session theft is short. Prioritize any host that has flagged a stealer detection in the past several months and was cleaned without a credential and session reset afterward — that is the case where a token is quietly still valid.
Force a global sign-out and re-authentication on AI service accounts for anyone whose device shows any stealer indicator, and confirm that the vendor’s sign-out actually invalidates tokens server-side rather than only clearing the local browser. Remove saved payment methods from accounts staff use for work, and move that spend to a corporate mechanism with its own controls.
Set a usage alert rather than relying on someone noticing. On any metered AI account, an unexplained jump in consumption, or a limit reached far earlier in the period than usual, is now a security signal and should be routed as one. Where the vendor offers session or device management, review active sessions and revoke anything unrecognized.
Finally, tell staff what the legitimate notice looks like, and that the fix is a device cleanup, not a password change. An email that says the vendor already signed you out and already removed your card is exactly the pretext an attacker would use next.
Sourcing note
This story is thinly sourced by design of the disclosure, not by choice. The quotations above are as reproduced by BleepingComputer and Search Engine Journal on August 30, 2026, both working from an email a recipient posted publicly. Severity Daily has not seen the email, has not verified its headers, and cannot confirm the passages are complete or unedited. The two outlets’ renderings of the text are consistent with each other, which is corroboration of the reporting but not of the document.
Severity Daily checked two Anthropic primary sources directly. The company’s newsroom carries no post dated August 28, 29, or 30, 2026 and nothing on account security, session theft, or infostealer activity. The company’s status page carries no incident or notice for those dates. Both checks were made before publication. Anthropic has published no security bulletin, no advisory, and no indicators, and had made no public statement on the matter at the time of writing.
Unresolved: the number of accounts affected, the date the activity began, the date Anthropic detected it, the period over which usage was consumed, and whether any data in the affected accounts — as opposed to the accounts’ metered capacity — was accessed. The notice as reported does not address that last point either way, and this page does not assume an answer. No attribution is stated here; the malware families named are commodity tools used by many unrelated operators, and naming them identifies the tooling, not the operator.
