Anthropic Forces Logout for Claude Users After Malware Breach

How Infostealers Compromise AI Account Security

Anthropic has forced a large number of Claude users to sign out of their accounts. The company removed saved payment methods and issued refunds following an infostealer malware incident. This security measure affected users who accessed the platform through compromised browsers. The action occurred on August 30, 2026. It follows a broader wave of cyberattacks targeting major AI infrastructure providers.

The decision stems from a sophisticated infostealer campaign. These malicious tools steal sensitive data like cookies and session tokens. Attackers used this stolen information to gain unauthorized access to user sessions. Anthropic identified the breach pattern quickly. They prioritized removing stored financial data to prevent fraudulent charges. Refunds were processed automatically for affected transactions. This proactive step aims to restore user confidence in the platform's security protocols.

Why Did Anthropic Remove Payment Data?

Infostealer malware operates by hijacking browser sessions. It captures authentication tokens without needing passwords. Once attackers hold these tokens, they can act as the legitimate user. They can view chats, modify settings, or make purchases. Anthropic’s response involved invalidating all active sessions linked to compromised endpoints. The company scanned for anomalous activity patterns. This process helped identify which specific accounts were at risk. Users received notifications explaining the logout requirement. The removal of payment details ensured that new charges could not be made easily. This layered defense addresses both access and financial risks simultaneously.

Anthropic removed saved payment methods to cut off the attack vector. Stolen session tokens allow attackers to initiate new subscriptions or one-time payments. By clearing stored cards, the company reduced potential financial losses. This move also simplified the refund process for users. It prevented double-billing scenarios during the recovery phase. The company emphasized that no personal data was directly exposed in the database. The breach remained confined to the client-side browser environment. This distinction is crucial for understanding the scope of the incident.

Did Anthropic lose user chat history? No, the core data remained secure on the server side. The breach primarily affected session authentication and payment storage. Users regained full access after re-authenticating their accounts.

Frequently Asked Questions

Are refunds automatic for all affected users? Yes, Anthropic processed refunds for transactions made during the vulnerable window. Users do not need to file manual claims for most cases. The system handled the reversal automatically upon detection.

How can users prevent future infostealer attacks? Users should keep browsers updated and use reputable antivirus software. Clearing browser caches after suspicious activity helps remove stale tokens. Enabling two-factor authentication adds an extra layer of protection against session hijacking.