Anthropic has warned some Claude users that infostealer malware on their computers allowed attackers to hijack login sessions and run up usage limits, according to an email the company sent to affected customers.
The company said it detected the activity, signed out the compromised sessions, and removed saved payment methods from affected accounts as a precaution.
Anthropic is alerting Claude AI users whose computers were infected with infostealer malware such as Vidar, Lumma, StealC, RedLine, and Acreed on Windows, along with Atomic Stealer (AMOS) on a small number of macOS devices.
The AI giant emphasized that the malware is general-purpose and not tied to Claude itself, typically arriving via unofficial downloads or malicious apps.
The company said the malware quietly copies saved passwords, browser login cookies, and credentials for other local applications.
Anthropic believes a threat actor subsequently began selecting the stolen Claude sessions out of that harvested data and using them to access accounts. Users who saw their usage limits appear to refill and then drain without actively using Claude were told this was the likely cause.