Notifications
Clear all
Topic starter
02/09/2026 1:29 pm
TL;DR: Anthropic says threat actors reused active Claude sessions stolen from infostealer-infected devices to bypass passwords and two-factor authentication, then consumed paid usage and forced session invalidation. The incident shows that valid session tokens, not credentials, can become the real control boundary once a login has already occurred, and revocation must reach the token layer.
NHIMG editorial — based on content published by Anomali: Stolen Claude Sessions Let Attackers Bypass Passwords and Two-Factor Authentication
Questions worth separating out
Q: What breaks when an attacker steals a live AI session instead of a password?
A: Password-based protection stops mattering once the attacker has a valid session token.
Q: Why do session hijacking and stolen browser cookies undermine MFA so effectively?
A: MFA mainly protects the authentication step.
Q: How should security teams respond when AI account sessions are reused from infected devices?
A: They should revoke the active session, isolate the device, look for other stolen secrets on the same endpoint, and reset any related credentials that may be cached or reused.
Practitioner guidance
- Invalidate sessions on endpoint compromise Build a playbook that revokes active AI and SaaS sessions when infostealer activity is suspected, then confirm token revocation across browsers, desktop clients, and mobile sessions.
- Treat AI account sessions as governed NHIs Inventory AI platform accounts, their active sessions, and the services they can consume.
- Harden endpoints against cookie theft Prioritise browser hardening, EDR coverage, and infostealer detection on devices that access identity providers, SaaS portals, and AI tools.
What's in the full analysis
Anomali's full article covers the operational detail this post intentionally leaves for the source:
- The specific malware families Anthropic named and how each one harvested browser cookies and saved credentials.
- The account response sequence used to invalidate sessions, remove payment methods, and refund unauthorized charges.
- The device-cleanup guidance for Windows and macOS users after a stolen-session event.
- The usage patterns that helped identify abuse while the legitimate user was idle.
👉 Read Anomali's analysis of stolen Claude sessions and MFA bypass →
Stolen Claude sessions: why session tokens still defeat MFA?
Explore further
02/09/2026 1:30 pm
Session tokens, not passwords, are now the durable attack surface in many identity programmes. This incident shows that MFA can be technically correct and still operationally insufficient if the session layer is unmanaged. The control boundary has moved from sign-in to token lifecycle, which is why identity teams need to measure active-session risk with the same seriousness they apply to credential exposure.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to the 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities.
A question worth separating out:
Q: Should organisations treat AI service sessions like privileged non-human identities?
A: Yes, when those sessions can consume paid usage, call tools, or reach sensitive data. They should be owned, monitored, and reviewed as governed identities, because their operational value and blast radius can be as high as a service account or API token.
👉 Read our full editorial: Stolen Claude sessions show why session tokens outlast passwords
