Compromised Claude session key reportedly used to create unauthorised Claude Code OAuth tokens

A compromised Claude session key was used to create unauthorised Claude Code OAuth tokens in one customer case, Anthropic reportedly told the user, extending earlier reports of an unidentified actor hijacking Claude account access through stolen authentication material.

TechCrunch reported the case on 8 September 2026, after publications had described Anthropic invalidating sessions linked to suspected account misuse. The measures concerned affected accounts. The available evidence does not show that Anthropic introduced automatic sign-outs for all Claude users or made blanket sign-outs a new product policy.

The first public report located during research came from BleepingComputer on 30 August. It reproduced parts of an Anthropic notification sent to an affected customer. SecurityWeek added details on 31 August. Engadget followed on 3 September, citing SecurityWeek and reporting that Anthropic had not responded to its request for comment.

According to the customer notifications reproduced by BleepingComputer, Anthropic attributed the activity to an unidentified actor using common infostealer malware on users’ computers. The company reportedly said the malware copied Claude authentication artefacts that were then used to enter accounts without a fresh interactive login and consume associated usage allowances.

Anthropic also reportedly told customers that this was general-purpose endpoint malware, not software installed through Claude or connected to their activity within the service. No public forensic report has validated that explanation across all affected accounts, and no compromise of Anthropic’s infrastructure has been established.

Customer emails reproduced by Dark Reading said Anthropic identified Vidar, Lumma or LummaC2, StealC, RedLine and Acreed on Windows, and Atomic Stealer, also known as AMOS, on a small number of Macs. Those malware-family identifications and their prevalence across the wider activity have not been independently verified.

The method matters because theft of an authenticated session differs from password theft. A reusable session artefact can represent an account that has already completed its interactive login. If an attacker can reuse it, the service may not request the password or issue a fresh multifactor authentication challenge for that access.

Multifactor authentication remains important for the Claude account and its associated email account, but it does not itself remove session material already copied from an infected device. Signing back in before cleaning that device could create fresh authentication material while the malware remains present.

Claude’s official support documentation says web sessions last for 28 days and are refreshed back to 28 days every hour while a user is active. It also documents a global logout control in web account settings that ends sessions across browsers, mobile devices and desktop applications.

SecurityWeek reported that Anthropic detected suspicious activity, invalidated affected sessions and removed stored payment methods. According to the report, the company also refunded charges it identified as unauthorised. Public accounts described unexplained depletion of usage allowances, including limits refilling and draining without the customer’s activity.

Customers whose sessions were terminated had to authenticate again. Those whose payment methods were removed also had to re-add their details, but Anthropic’s reported remediation sequence calls for the suspected endpoint infection to be addressed first.

The later Claude Code finding adds a separate authorisation concern. TechCrunch reported that Anthropic attributed one user’s unauthorised OAuth tokens to a compromised Claude session key. Claude Code users are advised to inspect their authorisation tokens and revoke any that are unrecognised or no longer required, rather than relying only on a web-session reset.

It remains unclear whether OAuth-token creation occurred beyond that case. Anthropic has not published a technical account explaining the relationship between stolen web sessions, compromised session keys and Claude Code OAuth authorisations. The reports do not establish one common technical pathway for every affected account.

Users who suspect infection should first scan the device and remove any malware before signing back into Claude. After cleaning the endpoint, they can use Claude’s web settings to terminate all active sessions and then authenticate again. Claude Code authorisations require a separate review.

The associated email account also needs attention. The reported guidance recommends changing its password, ending other email sessions and enabling multifactor authentication. Credentials previously saved in affected browsers should be changed, other online accounts checked for unauthorised access, and card statements reviewed. Payment details should be restored to Claude only after the suspected device has been cleaned.

No patch or fixed software version applies to the reported activity. It concerns authentication artefacts allegedly taken from user-controlled endpoints, not a disclosed vulnerability in a particular Claude release.

The campaign’s scale and status remain unknown. No victim total, confirmed start date, actor identity or geographic distribution has been published, and independent telemetry has not established whether activity continues. The actor has not been linked publicly to any named criminal group, marketplace, country or state sponsor.

The extent of access beyond usage consumption is also unresolved. The available material does not establish whether the actor viewed or exported conversations, files, account details or other customer content. No breach of Anthropic’s systems has been established.

The issue is potentially relevant to Australian Claude users because endpoint infostealers and stolen web sessions are not geographically constrained. However, the reviewed reporting identifies no confirmed Australian victim, local impact figure or Australia-specific advisory.

Anthropic communicated through direct customer notifications, but no incident-specific public advisory or forensic report had been located by the research cut-off on 11 September 2026. Without such a disclosure, the breadth of the Claude Code token issue, the extent of any data access and the status of the wider account-hijacking activity remain unresolved.

Reusable session material and separate OAuth authorisations make account security a question of layered trust, not passwords alone. To map those relationships, turn to The Hack Academy’s online cybersecurity training programme, which lists cybersecurity fundamentals and internet vulnerabilities and offers self-paced learning with practical exercises alongside theory.