GoKawiilAnthropic has been signing users out of their accounts, deleting saved payment cards and refunding charges after attackers used stolen browser data to burn through victims' usage limits. That's according to an email the company sent to affected users last week, which has since been shared publicly on Reddit.
As reported by SecurityWeek, the AI giant points to customers' own computers rather than any breach at Anthropic, telling affected users that infostealer malware had harvested active Claude login sessions from their own PCs. Once inside affected accounts, the attacker(s) could burn through usage limits and make unauthorized Claude charges. "If your usage limits looked like they refilled and then drained while you weren't using Claude, this was likely the cause," the email reads.
In response, Anthropic said it forced sign-outs of affected sessions, removed the card on file and refunded any extra usage charges it tied to the activity. While this stops the stolen sessions, Anthropic told affected users that this doesn't remove the malware.