‘[the victim] managed to track the malware down with the help of Claude Opus 5 Max and, they believe, cleaned the system. “But last night I received this email from Anthropic warning me of an attempt to steal tokens via the API.”
The question is what is actually the case. Is Claude just giving an erroneous “all clear” message, so the victim is still being victimised, or did the victim clean their system correctly and the fraud happened a day later using creds stolen while the malware was still active?
Seems to me that malware operators start using stuff as soon as they get it, because they know it’s only a matter of time before they’re caught. The hacking that the victim is aware of happened “a few days ago.” And they were notified by Anthropic “last night.”
Hard to know whether they should consider their system clean because Claude says it is.
https://www.theregister.com/security/2026/08/31/anthropic-cracks-down-on-hijacked-user-accounts-mining-ai-tokens/5293461
Paco Hope
npub18m…edgg0
2026-09-07 20:57:50 UTC
Author Public Key
npub18mdv65n7xqd0dhu0895tw6xkkxmhereksgqs60087ng855cmeqkqmedgg0Published at
2026-09-07 20:57:50 UTCEvent JSON
{
"id": "4351fdc2322e96de36a5668b9280bd07b6479f3d21a395b370f08e986c5f75a4",
"pubkey": "3edacd527e301af6df8f3968b768d6b1b77c8f3682010d3de7f4d07a531bc82c",
"created_at": 1788814670,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@paco/117231758266633154",
"web"
],
[
"proxy",
"https://infosec.exchange/users/paco/statuses/117231758266633154",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/paco/statuses/117231758266633154",
"pink.momostr"
],
[
"-"
]
],
"content": "‘[the victim] managed to track the malware down with the help of Claude Opus 5 Max and, they believe, cleaned the system. “But last night I received this email from Anthropic warning me of an attempt to steal tokens via the API.”\n\nThe question is what is actually the case. Is Claude just giving an erroneous “all clear” message, so the victim is still being victimised, or did the victim clean their system correctly and the fraud happened a day later using creds stolen while the malware was still active?\n\nSeems to me that malware operators start using stuff as soon as they get it, because they know it’s only a matter of time before they’re caught. The hacking that the victim is aware of happened “a few days ago.” And they were notified by Anthropic “last night.”\n\nHard to know whether they should consider their system clean because Claude says it is.\n\nhttps://www.theregister.com/security/2026/08/31/anthropic-cracks-down-on-hijacked-user-accounts-mining-ai-tokens/5293461",
"sig": "d87c8cdf2688bab7421be74b0d4c8d306d675f915509636121d2dd56c7ceb56c7b39f9869dfb5450eaad6a3c9e1464a60152beced082c14690b608c683c37d69"
}