Stolen Claude session cookies can reach corporate Gmail through grants no IT admin can revoke

Infostealers replayed stolen Claude session cookies into paid accounts without ever touching the login page two-factor authentication guards. The accounts Anthropic flagged were...