Anthropic has warned some Claude users that criminals are using information stealers to take over their accounts.

Rather than guessing passwords or intercepting two-factor authentication (2FA) codes, the attackers steal the browser sessions that prove a user is already logged in.

According to a warning email shared publicly by an affected user, the attackers used common infostealer malware to copy Claude login sessions from victims’ computers. They then used those sessions to access the accounts and consume their usage.

“We recently signed you out of Claude and removed the payment method saved on your account, so you’ll need to log back in and re-add your card. We’re sorry for the disruption. Here’s what happened and what we’ve done about it.

What happened

We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers, then using those login sessions to access Claude accounts and consume their usage. Our systems detected this activity on your account, and we’ve therefore removed your card on file and signed out the sessions involved to help block further unauthorized access.

If your usage limits looked like they refilled and then drained while you weren’t using Claude, this was likely the cause.”

The message adds that Anthropic has no reason to believe the malware was “related to Claude, installed through Claude, or related to anything you did with Claude.”  

To sum this up:

• Cybercriminals are spreading infostealers. How they are doing this and whether they are targeting groups likely to use Claude professionally is unknown.
• Infostealers can bypass standard credentials and multi-factor authentication (MFA) by stealing active browser sessions and session cookies.
• Once they are able to take over a Claude account, they can consume the victim’s usage and potentially incur additional charges.
• Anthropic is signing affected users out of Claude, removing saved payment methods, and refunding charges it identifies as unauthorized.

To better understand this, you should know that paid Claude plans can offer additional “Usage credits.” When a subscriber reaches the plan’s session limit, Claude can allow them to continue using the service through consumption-based billing at standard API rates. The user must enable the feature, configure a monthly spending limit or select unlimited spending, and prepay for credits.

Users can also enable auto-reload, which automatically buys more prepaid credits when the balance falls below a threshold. So, in a session-hijacking scenario, a thief could use up the account’s included allowance and any available Usage credits. If auto-reload is enabled, they could also trigger further purchases.

The criminals’ likely motive is to use paid Claude capacity for free. The account and any exposed data could also be useful for fraud, social engineering, or follow-on attacks.

Stolen Claude capacity could be used to write and refine phishing and scam content, build campaign infrastructure, develop, modify, or obfuscate malware, improve delivery methods, and analyze stolen information. Cybercriminals can use AI to support several parts of an operation, although Claude has safeguards and abuse monitoring, and Anthropic says it has disrupted accounts used for malicious activity.

What to do

Anthropic provided advice for dealing with a possible infostealer infection. After removing the malware, we recommend you install an up-to-date, real-time anti-malware solution to help protect you against new infections.

These steps are good practice when cleaning up after infostealer malware:

1. Scan any computer you use with Claude for malware and remove any malware before logging back in or changing passwords.
2. Once the malware has been removed, secure the email account you use for Claude by changing its password, signing out of other devices, and enabling two-factor authentication (2FA).
3. Change sensitive passwords that were saved in the affected browser, including those for banking, work, and cloud services. Check your card statements if you stored payment details in the browser.
4. Only after completing these steps should you add your payment method to Claude again if you want your plan to continue renewing.

If you still see your usage changing while Claude is idle, or notice an unrecognized charge after completing these steps, contact usersafety@anthropic.com.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Reddit users found that by using a specific Google search query, it was possible to find Claude conversations that users had shared.

This exposed sensitive material, including crypto wallet keys, names, addresses, work notes, and even erotic or otherwise policy-violating chats. Fortune says Anthropic appears to have fixed the Google indexing issue, but the shared links themselves were still live for people who already had them.

The exposure was tied to Claude’s Share feature, which creates a public web link to a snapshot of a conversation rather than leaving it inside a user’s private account. Reddit users found a search query that surfaced many of these shared chats, plus Claude Artifacts (interactive documents, apps, and other content created by Claude) in Google results. Wired reports that this is still true for Bing.

The main risk is that people use chatbots to think through work, health, legal, or personal matters without realizing that a shared link can behave like ordinary public web content.

This isn’t unique to Claude. We’ve previously seen Grok chats show up in Google search results, and Meta AI conversations can also become public by design. We have also written about the share option in ChatGPT that was swiftly removed after users unintentionally made thousands of conversations searchable.

Anthropic says Claude chats are private by default, and only conversations users explicitly chose to share were affected. But the incident is a reminder that a “share” button on an AI chat can be more like publishing than messaging, especially if search engines can discover the resulting URL.

How to stay safe

The easy way out here is not to share your AI chatbot conversations with anyone, because you could end up reaching more people than you intended.

That’s because it’s harder to stop pages from being indexed than you might expect. And you don’t have those controls in your hands. The AI provider should take care of that.

But there are a few things you can do:

• Don’t share Personally Identifiable Information (PII) with a chatbot, so that if a conversation is ever exposed it can’t be easily linked back to you.
• To review or stop sharing conversations in Claude, go to Settings > Privacy > Shared chats.
• If you’re using an AI service from a social media company, such as Meta AI, Grok, or Gemini), remember that your conversations could be tied to your account—which might contain a lot of personal information.
• When using AI, make sure you understand how to keep your conversations private. Many services offer temporary or incognito chats that aren’t saved to your history, but they aren’t a guarantee against bugs, leaks, or data breaches. Only use the share feature when you’re comfortable with anyone potentially seeing that conversation.
• Read the privacy policy so you understand how your conversations are stored and shared. If it’s too long, you can always ask an AI to summarise the important points.

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. 

Enterprise adoption of Claude across teams, workflows, and business functions is happening at a pace unlike virtually any technology before it. While the innovation opportunity is obvious, so are many of the risks. From the exposure of sensitive data and secrets through shadow IT to new attack vectors like prompt injection, security teams need the visibility, governance, and response capabilities to ensure AI innovation is done safely and securely.

SentinelOne® helps organizations comprehensively secure Claude adoption by bringing AI usage directly into the security platforms teams already rely on. This helps protect the entire ecosystem from the underlying infrastructure to the application layer and end-user interactions. By bringing together SentinelOne and Claude, security teams can apply policies to user prompts, ingest Claude activity into the Singularity AI SIEM for investigation, and utilize frontier AI-powered services to identify real-world risks before attackers can exploit them.

Govern, Detect & Secure with SentinelOne’s Anthropic Compliance API Integrations

Security and compliance platforms utilize the Claude Compliance API to help organizations monitor AI activity within their existing tools. SentinelOne provides purpose-built Claude Compliance API integrations for its Prompt Security and Singularity AI SIEM offerings.

Prompt Security Integration

Scan AI prompts and responses against enterprise policies to flag violations without requiring a browser extension or endpoint agent. This agentless approach helps organizations extend their security coverage to unmanaged devices and external environments. Prompt Security enforces safe use by blocking high-risk prompts and preventing data leakage in real time. Additionally, the platform provides continuous risk assessment for agentic AI by securing Model Context Protocol (MCP) gateway connections between AI applications and known MCP servers.

Singularity AI SIEM Integration

Ingest audit and activity data directly from Claude rather than treating AI interactions as isolated events. With the integration, security operations center (SOC) teams can correlate Claude activity against existing security telemetry. This allows analysts to incorporate AI usage data into their broader security workflows and improve investigation, detection, and response across all their attack surfaces.

AI Visibility to AI-Ready Defense with Wayfinder Frontier AI Services

The partnership between SentinelOne and Anthropic extends beyond the Compliance API. SentinelOne has been a participating member in Anthropic’s Project Glasswing and has had early access to Anthropic’s most capable Mythos-class models. By continuously testing these models against real-world security workflows, SentinelOne helps ensure defenses keep pace with the modern adversary. Additionally, SentinelOne recently announced Wayfinder Frontier AI Services, a managed offering that pairs elite human security experts with frontier models, including Anthropic’s Claude Security.

Frontier AI is changing vulnerability discovery, giving both defenders and attackers the advantage of speed and scale. However, raw vulnerability counts rarely map cleanly to real-world risk, as many theoretical exposures are mitigated by existing architectural controls. Wayfinder Frontier AI Services evaluates findings against actual environmental context to deliver an exploitability-grounded prioritization. Instead of treating vulnerabilities in isolation, the service maps how exposures connect into end-to-end attack paths.

The Frontier AI models then provide targeted remediation guidance, including architectural changes or identity controls, designed to break the exploitation chain where it costs the adversary the most. With the service providing a continuous human-and-AI partnership across endpoint, cloud, identity, data, and AI attack surfaces, Frontier AI ensures that organizational security posture remains current as models and threats evolve.

Why SentinelOne is Built for the AI Security Era

SentinelOne operates from a clear conviction: A safer future for humanity and to give the advantage to those who secure our future. That conviction is what drives how SentinelOne approaches AI security — not as an isolated capability, but as part of the autonomous platform, expert services, and SOC workflows that defenders already use. SentinelOne has collaborated with frontier AI labs for years, including Anthropic, OpenAI, and Google DeepMind. These partnerships inform the capabilities embedded across the SentinelOne platform.

Operating at machine speed is necessary to counter modern threats, rather than relying strictly on manual triage. Over the past quarter, the SentinelOne Singularity Platform autonomously blocked novel zero-day and supply-chain attacks against widely used components, such as LiteLLM, Axios, and CPU-Z. Wayfinder Frontier AI Services takes this operational model further left in the security lifecycle to discover exposures before attackers can leverage them. This multi-model foundation reflects the understanding that no single AI model is the definitive answer for cybersecurity; the advantage belongs to defenders who can orchestrate the right intelligence and validate outputs with human expertise.

This is how SentinelOne enables business growth and innovation safely, giving security teams the ability to say yes to AI adoption while maintaining full control of the risk surface. Stronger protection with fewer incidents and less operational overhead.

Learn More

Ready to adopt Claude safely across your organization? Connect with SentinelOne to learn how Prompt Security, Singularity AI SIEM, and Wayfinder Frontier AI Services help security teams govern, monitor, and defend AI usage at enterprise scale.

• For Claude governance and monitoring: Contact SentinelOne to learn about the Anthropic Compliance API integrations for Prompt Security and Singularity AI SIEM.
• For proactive AI-driven exposure management: Learn more about Wayfinder Frontier AI Services.
• For broader AI security: Request a demo of SentinelOne’s AI security capabilities.

Third-Party Trademark Disclaimer:

All third-party product names, logos, and brands mentioned in this publication are the property of their respective owners and are for identification purposes only. Use of these names, logos, and brands does not imply affiliation, endorsement, sponsorship, or association with the third-party.