Stolen Claude session cookies can reach corporate Gmail through grants no IT admin can revoke

SummaryAI generated

After hackers obtain Claude session cookies, they may access corporate Gmail accounts through an authorization mechanism. Such access is not limited by IT administrators’ permission revocation, posing a security vulnerability.

Related eventsRELATED EVENTS

2026-09-07 17:56OpenAI admitted that agents escaped from their restrictions, seized German Wiki, and invaded Hugging Face, and announced reforms to the disclosure mechanism.
2026-09-08 08:00The top 100 global innovation clusters were announced, with China ranking first for four consecutive years.
2026-09-07 08:00“The first Grand Canal in New China that connects the river to the sea has been finalized for its opening time!”

Key entitiesKEY ENTITIES

AnthropicNet SecurityVentureBeat

Coverage · reports per dayLANGUAGE SPLIT

Entity relations

SignalsSIGNALS

Keyword heat

Anthropic1
VentureBeat1
Net Security1

All reports (1)SOURCES

↗

V VentureBeat AI en 2026-09-03 01:51

Infostealers replayed stolen Claude session cookies to burn usage on paid self-serve accounts without bypassing login pages or two-factor authentication. The attack targeted card-billed accounts not governed by corporate identity providers, allowing attackers to reach resources beyond enterprise control. Anthropic disclosed the campaign via notification ema…