On August 30, Anthropic began emailing Claude users to tell them their accounts had been accessed by someone else. The attackers had not guessed passwords or defeated two-factor authentication. They had stolen active session cookies from machines already infected with commodity infostealer malware — Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, Atomic Stealer on a small number of Macs — and simply walked into sessions that were already authenticated. Anthropic revoked the sessions, removed saved payment methods, refunded unauthorized charges, and told users plainly that signing out does not remove the malware.
The same weekend, the security researcher Simon Willison published an analysis of OpenAI’s newly expanded ChatGPT Work, which combines code execution with internet access, a headless Chrome browser that can load pages and run JavaScript against the DOM, a persistent filesystem shared across sessions, deployable websites, parallel sub-agents, scheduled automations, and 44 built-in skills. His conclusion was three words long: it “combines all three.”
The three are what he calls the lethal trifecta: access to private data, exposure to untrusted content, and the ability to communicate outward. Any system with all three can, in principle, be instructed by content it reads to take your data and send it somewhere.
Two very different incidents. One underlying condition.
“What connects them is that the credential and the capability have merged,” says Hassan Taher, an AI analyst and author who advises organizations on enterprise AI strategy. “For thirty years security has been organized around the idea that authentication is the hard part and authorization is a configuration detail. An AI agent inverts that. Getting into the account is the easy part now, because the account is a persistent session on somebody’s laptop. What you get when you are inside is not a mailbox. It is an entity with credentials, tools, network access, and the standing authority to act on the user’s behalf without being asked again.”
The Session Is the New Password
The Anthropic disclosure is worth reading carefully because of what it says about the failure mode rather than the scale.
Infostealers are not sophisticated. They are commodity malware, distributed through pirated software, malicious ads, and fake installers, and they have been draining browser credential stores for years — the same unglamorous category Hassan Taher has written about in staying protected in the age of AI scams. What changed is what is now in the credential store. A stolen session token used to get an attacker into a webmail account or a shopping site. It now gets them into a tool with a paid usage allowance, an API surface, uploaded documents, conversation history, and in many configurations, connected systems.
The immediate harm Anthropic described was usage-limit theft — attackers burning through paid capacity. That is the cheap, visible version of the attack. The expensive version is quieter: an attacker who reads six months of an executive’s conversations, which frequently contain the strategy documents, financial models, personnel discussions, and unreleased material that were pasted in for summarization.
Anthropic’s guidance is correct and insufficient: change credentials, revoke other active sessions, remove the malware. It is insufficient because it puts the burden on the endpoint, and the endpoint is the part of the enterprise that organizations have spent two decades failing to fully control.
The Trifecta Problem Has No Patch
The ChatGPT Work analysis describes a harder problem, because it is not a vulnerability. It is a consequence of the product working as designed.
An agent that is useful in an enterprise context needs access to internal data — that is the value. It needs to read external content — documents, web pages, emails, tickets, code repositories — because that is where the work is. And it needs to act — write files, call APIs, send messages, deploy things — because an agent that only reads is a search box. Remove any one of the three and the product stops being worth deploying. Keep all three and the system can be steered by any text it encounters. This is the bargain built into the category itself, as Hassan Taher has laid out in explaining what agentic AI actually is: the autonomy is the product.
Prompt injection has no clean fix for a reason that is structural rather than temporary. In a conventional system, instructions and data travel in separate channels, and the security model rests on never confusing them. A language model has one channel. The instruction from the operator, the instruction from the user, and the sentence embedded in a PDF footer all arrive as tokens in the same context window. Mitigations exist — sandboxing, allowlists, human approval gates, output filtering, auto-review of agent actions — and they reduce risk substantially. None of them restores the separation, because the separation was never there.
“The honest framing is that this is a containment problem, not a bug-fixing problem,” Taher observes. “You are not going to patch your way to an agent that cannot be socially engineered by a document. What you can do is decide, deliberately, what an agent is permitted to reach and what it is permitted to do, and make those boundaries narrow enough that a successful injection produces an annoyance rather than a breach. That is unglamorous engineering, and it is the whole of the defense.” The gap between a working demonstration and a system that survives contact with production is the same one he has described in enterprises taking AI agents into production, where controls that seemed like friction during the pilot turn out to be the only thing standing between a capable agent and an expensive mistake.
What Enterprises Should Actually Change
Four things are worth doing now, and none of them require waiting for a vendor.
Treat AI session tokens as privileged credentials. They currently sit in browser storage alongside session cookies for far less consequential services, with lifetimes measured in weeks. Shorten them. Bind them to device posture where the platform supports it. Include them in the credential-rotation playbook that already exists for VPN and SSO, and make revocation something the security team can execute centrally rather than something each user does individually.
Inventory what your agents can reach. Most organizations that have deployed AI assistants cannot produce a current list of the data sources, integrations, and tools each one is connected to. That list is the blast radius. If it cannot be produced on request, the risk cannot be assessed, and any statement about exposure is a guess.
Separate reading from acting. The trifecta only becomes lethal when all three properties coexist in one context. Agents that process untrusted external content should not hold write credentials to systems of record. Agents that act on internal systems should operate on a restricted, curated input surface. This costs capability. It is worth the cost.
Log agent actions as security events, not as product telemetry. When an agent takes an action, the record needs to live where the SOC can see it, with the same retention and alerting as any other privileged action. Most AI action logs today live in a product analytics pipeline that no one monitors for abuse.
The Broader Point
There is a version of this moment that gets narrated as AI being uniquely dangerous. That framing is not quite right, and it is unhelpful because it invites either paralysis or dismissal.
The accurate framing is more mundane and more actionable. Enterprises have spent thirty years building a security model around the assumption that software does what it was programmed to do, and that the unpredictable element is the human operator. Agentic AI introduces software that is itself unpredictable, that holds delegated authority, and that can be influenced by any text it reads. The existing model does not fail catastrophically against that — it just was not designed for it, and the gaps show up in exactly the places these two incidents landed: at the session boundary and at the capability boundary.
“The organizations that handle this well will not be the ones that deploy the least AI,” Taher says. “They will be the ones that decided early that an agent is a privileged identity in the environment, subject to the same scrutiny as a service account with administrative rights — provisioned deliberately, scoped narrowly, monitored continuously, and revocable in one action. Most enterprises are treating agents as features. The ones treating them as identities are going to have a much easier next two years.”
Sources:
- Anthropic warns infostealer malware is hijacking Claude sessions to drain usage — BleepingComputer
- Understanding ChatGPT Work — Simon Willison
- Anthropic Users Hit by Infostealer Attacks, Session Thefts — Dark Reading
- Anthropic Warns Hackers Are Stealing Claude Sessions To Hijack Accounts — Search Engine Journal
- The Comprehensive Guide to Prompt Injection Attacks in 2026 — Sysdig
