Hackers Are Draining AI Accounts Without Your Password: How Stolen Session Tokens Work — and How to Stop Them
Attackers are logging into people’s Claude and ChatGPT accounts and running up their usage — without ever knowing the password or touching two-factor auth. The trick is stealing your already-logged-in session, and it works on almost any AI service. Here’s exactly how it happens and the handful of habits that shut it down.