Stolen Claude sessions show why session tokens outlast passwords

At a glance

What this is: This incident shows threat actors using stolen Claude sessions to bypass passwords and 2FA, proving that active session tokens can be more valuable than stolen credentials.

Why it matters: It matters because IAM teams must treat session lifecycle, device hygiene, and token revocation as first-class controls for both human access and AI service accounts.

👉 Read Anomali's analysis of stolen Claude sessions and MFA bypass

Context

Stolen session tokens are a different control problem from stolen passwords. Once an attacker reuses a valid session cookie, authentication has already happened, so MFA can no longer protect that live session by itself.

This matters for IAM, NHI governance, and AI service access because session state often outlives the original login event. The article shows a common gap in identity programmes: organisations protect the sign-in step but underinvest in session revocation, token hygiene, and endpoint compromise response.

Key questions

Q: What breaks when an attacker steals a live AI session instead of a password?

A: Password-based protection stops mattering once the attacker has a valid session token. The attacker can act as the user until the token is revoked, which is why session lifecycle, not just authentication strength, becomes the control boundary. Organisations need visibility into active sessions, rapid revocation, and endpoint containment when theft is suspected.

Q: Why do session hijacking and stolen browser cookies undermine MFA so effectively?

A: MFA mainly protects the authentication step. If an attacker already has a valid session token or cookie, they can often act as the user without re-entering MFA. That is why browser compromise, endpoint malware, and token theft are so dangerous. The control gap is not the login prompt, but the trust placed in an authenticated session after login.

Q: How should security teams respond when AI account sessions are reused from infected devices?

A: They should revoke the active session, isolate the device, look for other stolen secrets on the same endpoint, and reset any related credentials that may be cached or reused. If the account has billing, tool, or data access, teams should also review usage for abuse during the compromise window.

Q: Should organisations treat AI service sessions like privileged non-human identities?

A: Yes, when those sessions can consume paid usage, call tools, or reach sensitive data. They should be owned, monitored, and reviewed as governed identities, because their operational value and blast radius can be as high as a service account or API token.

Technical breakdown

How stolen session cookies bypass password and MFA controls

A session cookie is a bearer token that proves an authentication event already succeeded. If malware steals that cookie from an endpoint, the attacker can reuse the session without knowing the password or second factor. This is why session theft is not the same as credential theft. The control failure is not at login but at the trust boundary that lets an already-issued session continue to operate. For identity teams, the important distinction is that authentication strength at enrollment does not automatically protect an active session once the device is compromised.

Practical implication: revoke active sessions and token grants when an endpoint is suspected of infostealer compromise.

Why AI service accounts behave like high-value non-human identities

The article shows that stolen Claude sessions were monetised through usage consumption, which turns an AI service account into an operational identity, not just a login target. In NHI terms, the value lies in the session’s authorisation state and associated billing or tool access. That changes the governance problem: the same session can drive cost, data exposure, and policy abuse without ever touching the password again. This is a classic NHI pattern, even when the identity subject is a human user of an AI platform.

Practical implication: monitor AI account sessions for abnormal consumption patterns and treat them as governed NHI assets.

What session invalidation actually closes in a compromised identity chain

Session invalidation terminates the bearer token, not the underlying endpoint infection. That means it can stop reuse of the stolen session, but it does not remove the malware that harvested it or the additional secrets the same host may expose. The broader architecture lesson is that identity recovery and endpoint recovery are separate workflows. If organisations collapse them into one response, they may close the account hole while leaving the collection mechanism intact for the next theft.

Practical implication: pair session revocation with endpoint containment, malware removal, and credential hygiene on the source device.

Threat narrative

Attacker objective: The attacker wanted to reuse valid AI service sessions to access accounts, drain usage, and monetise the stolen authenticated state.

1. Entry occurred through infostealer-infected Windows and macOS devices that harvested active Claude session material from local browsers.
2. Credential access came from reused session cookies that allowed the attacker to authenticate without the password or a 2FA code.
3. Impact followed when the attacker consumed paid usage and forced Anthropic to invalidate compromised sessions and remove saved payment methods.

Breaches seen in the wild

• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.
• GitHub Dependabot Breach — GitHub Dependabot tokens stolen and abused to push malicious commits to repositories.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Session tokens, not passwords, are now the durable attack surface in many identity programmes. This incident shows that MFA can be technically correct and still operationally insufficient if the session layer is unmanaged. The control boundary has moved from sign-in to token lifecycle, which is why identity teams need to measure active-session risk with the same seriousness they apply to credential exposure.

AI service accounts are becoming governed identities whether organisations model them that way or not. When a stolen Claude session can be consumed for paid usage, the account behaves like an NHI with real operational value. That makes usage anomaly detection, session revocation, and device compromise response part of NHI governance, not just SaaS hygiene.

Credential theft and session theft are converging, but the remediation path is not the same. Password resets address account authentication, while session invalidation addresses live bearer state. Identity programmes that treat those as interchangeable will keep missing the real attacker control point, which is the reusable token.

Ephemeral access is only safer if the session boundary is actually enforced. The industry has leaned on the idea that short-lived access reduces risk, but this case shows that short-lived or active sessions still become exploitable if the endpoint is compromised during their lifetime. The practical conclusion is that lifecycle controls must extend to revocation semantics, not just issuance.

From our research:

• 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to the 2024 Non-Human Identity Security Report.
• Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities.
• For a broader control baseline, read Ultimate Guide to NHIs - Static vs Dynamic Secrets for the lifecycle implications of short-lived versus reusable access.

What this signals

Session theft will keep outrunning password-centric controls: identity programmes need to assume that authenticated sessions can be stolen after the login step has already succeeded. That shifts emphasis toward token revocation, endpoint trust, and active-session telemetry rather than relying on sign-in assurance alone.

With 23.7% of organisations still sharing secrets through insecure methods such as email or messaging applications, the broader problem is not limited to passwords. The same weak handling patterns that expose secrets also expose browser cookies, session state, and AI account access.

For teams formalising their identity model, the next control layer is to connect 52 NHI Breaches Analysis with session governance so that SaaS, AI platforms, and service accounts are all treated as revocable identities rather than static logins.

For practitioners

• Invalidate sessions on endpoint compromise Build a playbook that revokes active AI and SaaS sessions when infostealer activity is suspected, then confirm token revocation across browsers, desktop clients, and mobile sessions.
• Treat AI account sessions as governed NHIs Inventory AI platform accounts, their active sessions, and the services they can consume. Apply ownership, logging, and review processes to usage-bearing sessions the same way you would for privileged service accounts.
• Harden endpoints against cookie theft Prioritise browser hardening, EDR coverage, and infostealer detection on devices that access identity providers, SaaS portals, and AI tools. A clean login flow does not matter if the source device can leak session tokens.
• Separate account recovery from malware recovery Require both identity-side remediation and endpoint-side cleanup before restoring access. Password changes alone are incomplete if the same device still holds malware capable of stealing the next session.

Key takeaways

• This incident demonstrates that a stolen session can defeat password resets and MFA because the attacker inherits an already-authenticated token.
• The scale problem is governance, not just malware, because AI service sessions now carry real operational and billing value.
• Identity teams should manage active sessions, endpoint hygiene, and token revocation as one recovery path, not three separate problems.

Key terms

• OAuth Token: A short-lived access credential issued by an OAuth 2.0 authorisation server granting an NHI scoped access to specific resources for a defined period. Preferred over static API keys because their short lifetime limits the exploitation window if intercepted.
• OAuth Token Abuse: The misuse of valid OAuth access or refresh tokens to gain unauthorized access without repeating the original login. In NHI terms, the token becomes the credential, so the real control problem is issuance, storage, scope, and revocation rather than passwords alone.
• Session revocation: The ability to invalidate active sessions so access ends immediately instead of waiting for tokens or browser state to expire. For identity governance, this is the control that determines whether authentication still matters after a compromise is detected.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

What's in the full analysis

Anomali's full article covers the operational detail this post intentionally leaves for the source:

• The specific malware families Anthropic named and how each one harvested browser cookies and saved credentials.
• The account response sequence used to invalidate sessions, remove payment methods, and refund unauthorized charges.
• The device-cleanup guidance for Windows and macOS users after a stolen-session event.
• The usage patterns that helped identify abuse while the legitimate user was idle.

👉 Anomali's full post covers the session theft chain, remediation steps, and user cleanup guidance.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.