In partnership with
Stop Paying for 10 Tools. One AI Does It All.
Most e-commerce sellers are running their store across 6 to 10 separate tools — and spending more time managing software than growing their business. StoreClaw replaces your entire stack with one autonomous AI engine that monitors competitors, optimizes listings, automates marketing, and tracks real profit across Shopify, Amazon, and beyond.
It doesn't wait for you to ask. It runs 24/7 in the background, so you wake up to a full dashboard instead of a list of things you forgot to check.
Connect your store, and StoreClaw gets to work — no prompts, no complex setup, no six-app stack.
Free to start. No credit card required.
AI & Technology Intelligence
AI NEWS INSIDER
Issue #72 · August 31, 2026
THIS WEEK: Hackers found a way into AI accounts that skips the password entirely. If your Claude or ChatGPT usage ever drained on its own, this is likely why.
6 MIN READ | Sharp, actionable intelligence
Hackers Are Now Stealing Your AI Login, Not Just Your Password
Malware doesn't need your Claude or ChatGPT password anymore. It just needs your browser's already-open session, and it can drain your account without you noticing until the bill, or the usage limit, says otherwise.
By AI News Insider Editorial · 6 min read
This week, Anthropic told a group of Claude users something unsettling. Their accounts had been logged into and drained of usage, without their password being stolen and without a single failed login attempt anywhere in their history. The company signed them out, removed their saved payment method, and refunded whatever unauthorized charges it could identify. Nothing about this story is unique to Anthropic. It's the same trick every major AI platform is now exposed to, and most people using AI tools for work have never heard of it.
How you get robbed without giving anyone your password
Security researchers call it session hijacking, and it works differently from the password theft most people picture. Infostealer malware, families with names like Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer on Mac, doesn't try to guess your password. It goes straight for the browser cookie that already proves you're logged in. Most of these tools finish stealing everything on an infected device in under 90 seconds, and many don't even need to stay installed to do it. Once an attacker has that cookie, they can open your Claude or ChatGPT account from their own computer, and the site sees a fully authenticated session. No password prompt. No MFA challenge. As one security researcher put it this year, the cookie is the new password.
This is not a small problem
Infostealers stole roughly 1.8 billion credentials from about 5.8 million infected devices in 2025 alone, an 800% jump from the year before, according to Flashpoint. More than half of ransomware victims last year had their credentials already sitting in a stolen-log marketplace before the attack even started, per Verizon's Data Breach Investigations Report. And the average organization now runs 16 different AI apps, according to browser security firm Push Security. Every one of those is a fresh account with a browser session that can be stolen the same way Claude's was.
What actually happened, and what to do about it
In the cases Anthropic disclosed, the malware was already sitting on the victim's computer, unrelated to anything the AI platform did wrong. That's actually the useful part of this story. A drained AI subscription is often the first visible symptom of a much bigger infection, one that may also have your email, your banking logins, and your company's SSO session sitting in the same stolen log. If your AI tool's usage limit refilled and then mysteriously drained while you weren't using it, treat that as a full device compromise, not an account glitch.
The Bottom Line for AI News Insider Readers
This is not a story about one company's security. It's a story about what "logged in" means now. A password can be strong and useless at the same time if the session behind it gets stolen instead. The S.A.F.E. framework below is the four-step version of what security teams do professionally, simple enough to run on your own accounts this week.
You don't need a security team to protect yourself from this. You need four habits, and about ten minutes today.
S. Scan the device, not just the account
If your AI subscription usage drained on its own, assume the device is infected before you assume the account was simply misused. Run a malware scan before you do anything else. Changing a password on an infected machine just hands the attacker a new one to steal.
A. Audit every active session
Most AI platforms, and most of your other SaaS tools, let you see and revoke active sessions and devices somewhere in account settings. Check today, not after something looks wrong. A session you don't recognize is the clearest early warning you'll get.
F. Force a full sign-out everywhere
Signing out on your own device is not enough. Revoke every active session from account settings so any copy of your stolen cookie stops working immediately, not just the one you personally closed.
E. Enable alerts, if your tools offer them
New-device logins, unusual usage spikes, and new payment activity are things some AI and SaaS platforms will notify you about, if you turn the setting on. Your own monitoring shouldn't depend on the vendor noticing first.
Your Monday Morning Action
Open your Claude, ChatGPT, or Gemini account settings today and look for "active sessions" or "connected devices." If you see anything you don't recognize, revoke it now, then run a malware scan on the device you're reading this on.
Funding
DeepSeek Nears $7.4B Round at $74B Valuation, Eyeing a 2027 IPO
The Chinese AI lab is closing roughly 50 billion yuan at a pre-money valuation of about 500 billion yuan, positioning it for a possible Shanghai STAR Market debut in 2027, joining the wave of AI companies racing toward public markets.
Advertising
OpenAI Expands ChatGPT Ads to 31 European Markets
The rollout builds on a US launch six months earlier. OpenAI says roughly 20% of ChatGPT queries already show direct commercial intent, and advertisers will initially buy through major agency groups before self-serve access arrives.
Voice AI
OpenAI Launches GPT-Live, a Native Voice Model With Sub-300ms Latency
The new model powers ChatGPT Voice directly, skipping the old text-pipeline approach and adding real emotional nuance, a meaningful step toward voice bots that don't sound like they're reading a script.
Enterprise
AI Agents Deployed per Organization Nearly Triple in a Year
The average organization now runs 13 AI agents, up from 5 in early 2025, according to Salesforce's Agentic Enterprise Index, another sign that AI access, not just AI usage, is quietly multiplying across the enterprise.
1.8B
Credentials Stolen by Infostealer Malware in 2025
An 800% jump from the previous year, per Flashpoint's 2026 Global Threat Intelligence Report.
<90 sec
Time Most Infostealer Variants Take to Steal Everything
Most Lumma and Vidar variants complete first exfiltration in under 90 seconds, often without staying installed.
54%
Ransomware Victims Whose Credentials Leaked First
Had their credentials already appear in stealer-log marketplaces before the attack, per Verizon's DBIR.
16
Average Number of AI Apps in Use per Organization
Each one a fresh browser session that can be hijacked the same way, per Push Security telemetry.
Push Security (Browser-Layer Identity and Session Protection)
The easiest way to live the "A" in the SAFE framework, at the organizational level
What it is: A browser security platform that sits inside employees' browsers to detect and stop session hijacking, AiTM phishing, and ClickFix-style attacks, while also giving security teams visibility into every AI app, extension, and OAuth integration employees are actually using.
Why it matters now: Most identity tools only see what happens inside a company's official login system, missing a cookie stolen before it ever reaches a login event. Push watches the browser itself, which is exactly where this week's AI account thefts happened.
Who gets it: Security and IT leads at companies where employees use multiple AI tools, official or otherwise, and need a way to see shadow AI usage before it becomes a shadow breach.
• Detects session hijacking and token theft at the browser layer, not just at login
• Surfaces shadow AI apps, extensions, and OAuth consent grants across the workforce
• Flags credential reuse and SSO gaps that traditional identity tools can't see
"The cookie is the new password."
Sila Özeren Hacioglu · Associate Security Research Engineer, Picus Security · on session cookie theft, 2026
Share AI News Insider
Know someone whose team runs AI tools every day? Forward them this issue before their next login.
SHARE & EARN REWARDS →AI News Insider · Your weekly edge in artificial intelligence
aiinsider247.com