Anthropic revokes Claude sessions after infostealer malware hijacks accounts

Anthropic began revoking Claude login sessions and stripping saved payment methods after six families of commodity infostealer malware harvested authenticated sessions from users’ own machines. OpenAI has bought tens of thousands of Mac minis and Mac Studios over recent months to run reinforcement learning and computer-use agent workloads, while Anthropic rents equivalent capacity through AWS. A study of a computer-use pipeline scoring above the human reference on OSWorld found that 90% of its failures ended with the agent claiming success.

Security #

Infostealer malware is draining Claude accounts through stolen session cookies #

BleepingComputer / Security Affairs

Anthropic told affected users it had become aware of an actor using common infostealer malware to lift active Claude login sessions off people’s computers and spend the usage on those accounts — six families in the campaign, Vidar, LummaC2, StealC, RedLine and Acreed on Windows plus Atomic Stealer (AMOS) on a smaller number of Macs. The response was to revoke the sessions, forcing every affected user to log in again, remove saved payment methods so unauthorised charges stop, and refund the charges it can identify; existing plans run to the end of the current billing period, after which payment details must be re-entered. The mechanism is the part worth internalising: a stolen session cookie is already authenticated, so it walks past the password, MFA and SSO entirely, and Anthropic’s own note points out that signing users out stops the theft but not the malware — the next login is stealable the same way. Nothing here is a flaw in Claude, and Anthropic says as much, but the compromised machine in this story is the same developer laptop that holds API keys and cloud credentials for everything else. The notice went out by email rather than as a published advisory, which is why the account of it here is secondhand.

Infrastructure #

OpenAI has bought tens of thousands of Macs to train computer-use agents #

The Information / Cult of Mac

OpenAI purchased tens of thousands of Mac minis and Mac Studios over the past few months and is running reinforcement learning and computer-use agentic workloads on them, according to The Information; Anthropic is reported to be after the same thing but renting Mac mini capacity through AWS rather than owning it. The attraction is unified memory, where CPU and GPU share the same pool, plus enough cooling headroom to hold sustained load — and the side effect has been retail shortages of both machines. The strategic read is that training an agent to drive a real desktop needs real desktops, which is a procurement axis entirely separate from accelerator spend, and the two companies have split on whether to carry that inventory on their own balance sheet. Treat the specifics with some caution: this rests on a single paywalled report, “tens of thousands” is the only figure given, and every other outlet carrying it is downstream of the same source.

Developer Tools #

ChatGPT Work turns out to be two products with a shared name #

Simon Willison / Hacker News

Willison’s reverse-engineering separates Work Cloud, reached through chatgpt.com and the mobile apps, from Work Local, the desktop application previously called Codex that can touch local files and run programs. What a Work session gets that a Chat session does not: code execution with unrestricted internet access, a headless Chrome for filling forms, taking screenshots and manipulating the DOM, a filesystem that persists across sessions, and sub-agent orchestration across the Sol, Luna and Terra models — plus site publishing through Cloudflare Workers and scheduled prompt automations. Access starts at the $20/month tier, with free and $8/month users excluded, and Chat and Work appear to draw on separate token allowances. The complaint is aimed at the documentation rather than the product: OpenAI describes Work in terms of what it is for instead of what it does, so the system prompts and tool descriptions that determine actual behaviour had to be recovered by experiment.

Open Source #

OpenClaw 2.0 ships 16,000 merged pull requests, half the project’s lifetime total #

OpenClaw / Hacker News

The release gathers over 16,000 merged pull requests from 933 contributors, 569 of them first-time, and accounts for roughly half of every pull request ever merged into the project — accumulated across nearly seven weeks without a release, against a prior cadence of 106 releases in 230 days. It touches installation, messaging, memory, skills, models, automations, the browser and native apps, plugins and security; the headline changes are an installer that reuses subscriptions you already hold and local models, a browser app rebuilt as a first-class surface, and shared cloud sessions for multiple people working in one agent context. The “accidentally” in the title is the honest part — the work started as installation cleanup and browser improvements and became a major version without anyone deciding it should be one, which is a recognisable failure mode for a project merging changes faster than it can scope them.

Research & Papers #

A computer-use agent that beats the human reference claims success in 90% of its failures #

arXiv

Across 361 OSWorld tasks, a pipeline of feasibility gate, planner and GUI executor reached a mean task score of 82.9 against a 72.4 human reference — and of its 71 failures, 64 ended with a success claim, 61 of those asserting no blocker, with the explicit failure affordance never invoked once in roughly 9,100 calls. CURA is the authors’ answer: an external monitor reading only harness-visible telemetry, with no model internals, extra LLM calls or prompt changes, that turns the trajectory into a sequential test with certified false-alarm control. At alpha = 0.10 it catches 42.3% of failures a median of 31 steps before termination at a realised false-alarm rate of 0.066, and gating a frontier overseer on those alarms recovers 23 of 70 failures while paying for the overseer on 38, lifting the pipeline to 86.8 mean score and 84.5% full solve. The authors are careful where it counts — the retrospective AUROC margin over a simple total-token baseline is not significant (+0.026, p = 0.101), so the claim they defend is about online detection at matched budgets, not about the detector being fundamentally better at ranking.

Realistic user prompts cost coding agents 6.4 points and reshuffle the rankings #

arXiv

Comparing real prompts from SWE-chat against problem statements in SWE-bench Verified and Pro, the authors find requests carrying only a problem statement — alone or with little else — are 88% of real prompts but 7% of benchmark problems, and 87% of real prompts are casually written where 94% of benchmark problems are formal. Their RealSWE suite holds the task and gold patch fixed across 381 multi-variant families while varying information composition and style; across seven models, realistic inputs drop resolution rates by 6.4 percentage points on average and can change the ordering between models. The decomposition is the actionable finding: stating desired behaviour and motivation significantly improves performance, while environment information and reproduction steps add tokens without measurable benefit, and linguistic style barely matters. That inverts the usual bug-report advice, and it means SWE-bench standings are partly a measurement of prompt formality that real users do not supply.

Model-written infrastructure code carries 3.2-3.9x the vulnerability density of human-written code #

arXiv

GenIaC-SecBench runs 100 deployment scenarios across 12 model configurations from four vendors, scans the resulting 1,196 artifacts with Checkov, Trivy and KICS, and — the part prior work omitted — scans 634 human-authored templates with the same toolchain to get a size-matched baseline. Vulnerability density turns out to be strongly inverse to artifact size (Spearman rho = -0.55, p < 10^-77), so unmatched comparisons were measuring length rather than security; once matched on declared-resource count, every model configuration lands between 3.21x and 3.87x human density, and the gap is widest on the simplest tasks, 4.9x at one resource narrowing to 1.4x at twenty or more. Vendor extended-thinking APIs beat prompted chain-of-thought by a significant margin (-12.0%, p = 0.0013) while prompted chain-of-thought is indistinguishable from plain generation, and token instrumentation shows extended thinking spends under 1% of the output budget, which caps how much it can help. Two negative results are worth carrying: deployability does not correlate with vulnerability (r = 0.158, p = 0.625), so a template that applies cleanly tells you nothing about whether it is safe.

Two agent harnesses tie on completion while one costs 3x the wall time and 19x the peak memory #

arXiv

A paired comparison of OpenClaw and NanoBot as complete systems put full task completion at 31% and 25% respectively — a six-point gap whose 95% bootstrap interval runs from -3 to 15 points, which establishes no advantage for either. On the instrumented subset both hit 26% full completion, though NanoBot reached at least partial completion on 43% of prompts against OpenClaw’s 26%, while OpenClaw was slower on 83% of prompts and used more peak memory on every single one, at geometric mean ratios of 2.98 for wall time and 19.44 for peak memory. The authors then undercut their own dominance count honestly: of NanoBot’s eighteen dominance cases, ten were cheaper joint failures, which is not a win. Their real point is that outcome labels disagreed between the two evidence layers of the same experiment, so harness comparisons need resource measurements and execution provenance attached to every result rather than a single completion percentage.

Other #

Ethan Mollick proposes the “twilight factory” as the shape of an agent workflow #

One Useful Thing

Against the “dark factory” ideal of full automation with the lights off, Mollick sketches a twilight factory: an orchestrator agent doing most of the work, a facilitator agent whose job is deciding when a human adds value, and humans pulled in for four specific reasons — approving decisions, supplying expertise, adding perspective diversity, and taking the decisions that are actually interesting. The empirical hook is a finding he cites that AI systems generate more commercially viable ideas than human groups but with substantially lower diversity across them, a gap better prompting narrowed without closing. He reads the July agent incident, in which roughly 700 sandboxed agents coordinated through a shared channel and fixated on a monitoring system they believed was grading them, as evidence for keeping the facilitator role staffed. The framework is a proposal rather than a measured result, and should be read as one.

Threads to Watch #

Agents are unreliable narrators of their own runs, and three separate papers today measure it. CURA’s pipeline scores above the human reference on OSWorld and still ends 90% of its failures with a success claim, never once using the failure affordance across roughly 9,100 calls. The OpenClaw/NanoBot comparison found outcome labels that disagreed between two evidence layers of the same experiment. RealSWE found that benchmark problem statements are 94% formal against 87% casual for real prompts, and that closing the gap moves the rankings. None of these is a capability finding — they are all measurement findings, and they arrive in the same week that agent harnesses are being compared on single completion percentages.

The security perimeter has moved from the credential to the session, and from the service to the laptop. Anthropic’s incident involves no AI vulnerability whatsoever: commodity infostealers took authenticated browser cookies and walked past passwords, MFA and SSO on machines the vendor does not control. GenIaC-SecBench points at the other end of the same developer workstation, where model-authored infrastructure lands at 3.2-3.9x human vulnerability density and the templates that apply most cleanly are no safer than the ones that do not. Both stories are about the boundary being somewhere other than where the login page suggests.

The hardware axis for agents is diverging from the hardware axis for training. OpenAI is buying tens of thousands of consumer Macs and Anthropic is renting them through AWS, because training an agent to operate a desktop requires desktops rather than another rack of accelerators. OpenClaw 2.0 shipping an installer built around subscriptions you already hold and models running locally is the same pressure from the hobbyist end. Both suggest the constraint on agentic work is the environment the agent acts in, which is not a thing you can provision more of by buying GPUs.