The modern knowledge worker often operates in a gray area of productivity, utilizing personal AI accounts to streamline corporate tasks. It starts with a simple convenience: connecting a personal Claude account to a professional Google Workspace to summarize a few emails or organize a drive. For the employee, it feels like a harmless efficiency gain. For the security team, it is the creation of an invisible, unmonitored bridge between a secure corporate perimeter and an external, third-party identity. This week, that bridge became a primary target for cybercriminals.

The Mechanics of the Session Replay Attack

Anthropic recently disclosed a sophisticated wave of session cookie replay attacks that allow unauthorized actors to bypass two-factor authentication (2FA) and access paid accounts. The attack does not rely on cracking passwords or phishing for 2FA codes in real-time. Instead, it leverages infostealers—malware designed to exfiltrate browser data—to steal active session cookies directly from a user's machine. Once an attacker possesses these cookies, they can inject them into their own browser, tricking the server into believing the attacker is the already-authenticated user. Because the session is already established, the security gates of Single Sign-On (SSO) and 2FA are completely bypassed.

The campaign utilized a diverse arsenal of six specific malware strains. Windows users were targeted by Vidar, LummaC2, StealC, RedLine, and Acreed, while Mac users faced the Atomic Stealer. These tools specifically target the browser's local storage to clone login cookies and saved credentials. The infection vectors were equally varied, ranging from the distribution of pirated software and games to more deceptive tactics. Some users were lured by fake download pages that abused Anthropic's own Artifacts feature, while others clicked on sponsored Bing advertisements as part of a broader campaign dubbed FakeAgent. In response to these breaches, Anthropic has moved to forcibly terminate compromised sessions, delete stored payment methods, and issue refunds for fraudulent charges.

The Shadow AI Pipeline and LLMjacking

While the theft of a personal account is a privacy concern, the architectural integration of AI agents transforms this into a systemic corporate risk. The critical vulnerability lies in the Connector feature, which allows Claude users to link their accounts to Google Workspace for direct access to Gmail and Drive data. When an employee links a corporate workspace to a personal, self-serve Claude account, they create a read-only path into the heart of the company's intellectual property. The danger is magnified by the lack of visibility; while IT administrators can manage corporate SSO identities, they have no window into the permissions granted by employees via their private accounts.

This phenomenon is the definition of Shadow AI, where AI tools are deployed across an organization without official IT oversight. Data from LayerX highlights the scale of this blind spot, revealing that 47% of all corporate AI interactions occur through personal identities. For Claude specifically, this figure climbs to 61%. This gap has birthed a new offensive trend known as LLMjacking, or LLM credential hijacking. According to analysis from CrowdStrike, stolen AI credentials have been traded on dark web markets since late 2022. Beyond data theft, these hijacked accounts are used for cost harvesting, where attackers exploit the paid resources of a victim's account to run their own heavy workloads at the victim's expense.

Moving Toward Ephemeral Identity Authentication

The current reliance on long-lived API keys and persistent session tokens is becoming a liability as AI agents gain more agency. When a token is stored in plain text on a local server or a device, it acts as a permanent key that remains valid until manually revoked. This is evident in the risks associated with local Model Context Protocol (MCP) servers, where long-term API keys are often cached, providing a static target for infostealers. The industry is now shifting toward a model of identity-based authentication with significantly shorter lifespans.

One prominent attempt to solve this is Okta's Agent SSO, released on August 24. This framework treats AI agents as first-class identities rather than mere extensions of a user. Instead of relying on static credentials, it issues short-lived, identity-based tokens that security teams can monitor and revoke natively. For developers and AI practitioners, this necessitates a three-pronged audit of their current pipelines. First, organizations must identify where personal AI accounts are being used as connectors to corporate data. Second, developers must eliminate the practice of caching long-lived tokens in plain text. Finally, a strict separation of permissions is required, where read access is granted by default but write access requires a separate, explicit approval process.

The era of static API keys is ending, replaced by a regime of ephemeral, identity-centric access.