--- title: Session hijackers drain Claude accounts, Linux CVE... description: Anthropic is warning that infostealer malware is hijacking authenticated Claude browser sessions to burn through usage without needing a password or 2FA. Linux... canonical: https://daily.dev/posts/session-hijackers-drain-claude-accounts-linux-cve-volume-doubles-under-llm-scrutiny-h4x5yvp2b twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Session hijackers drain Claude accounts, Linux CVE volume doubles under LLM scrutiny | daily.dev og:description: Anthropic is warning that infostealer malware is hijacking authenticated Claude browser sessions to burn through usage without needing a password or 2FA. Linux... og:url: https://daily.dev/posts/session-hijackers-drain-claude-accounts-linux-cve-volume-doubles-under-llm-scrutiny-h4x5yvp2b og:image: https://api.daily.dev/og/posts/H4X5Yvp2B.png og:image:alt: Session hijackers drain Claude accounts, Linux CVE volume doubles under LLM scrutiny og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Session hijackers drain Claude accounts, Linux CVE volume doubles under LLM scrutiny **[Security Digest](https://daily.dev/sources/security_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary Anthropic is warning that infostealer malware is hijacking authenticated Claude browser sessions to burn through usage without needing a password or 2FA. Linux kernel CVEs have shot past 1,500 per release, up from around 500, partly because LLM-assisted bug hunters are flooding maintainers with reports. Atlassian shared real numbers from three months of letting agents patch vulnerabilities automatically: 120+ fixes, 55+ merged PRs, 95% clean on the first try. Symfony 7.4.18 lands with an unusually dense batch of security fixes worth reading closely if you're on the framework. ## Content **TLDR:** Anthropic is warning that infostealer malware is hijacking authenticated Claude browser sessions to burn through usage without needing a password or 2FA. Linux kernel CVEs have shot past 1,500 per release, up from around 500, partly because LLM-assisted bug hunters are flooding maintainers with reports. Atlassian shared real numbers from three months of letting agents patch vulnerabilities automatically: 120+ fixes, 55+ merged PRs, 95% clean on the first try. Symfony 7.4.18 lands with an unusually dense batch of security fixes worth reading closely if you're on the framework. --- ## Anthropic: infostealers are hijacking authenticated Claude sessions to drain usage Vidar, LummaC2, StealC, RedLine, Acreed, and Atomic Stealer are stealing browser login sessions from infected machines, letting attackers ride an already-authenticated Claude session without ever touching a password or 2FA prompt. Anthropic says Claude itself isn't compromised — this is standard credential-theft malware exploiting the fact that a stolen session cookie is as good as a login. The company is signing out affected accounts, stripping saved payment methods, and refunding unauthorized charges, but signing out doesn't clean an infected machine, so anyone affected needs to actually remove the malware and rotate credentials. [Read more](https://daily.dev/posts/Z5uCaK5u9) ## Linux kernel CVE volume triples as LLM-assisted bug hunting floods maintainers Kernel CVEs per release have jumped from roughly 500 to over 1,500, and part of that surge is LLM-assisted researchers finding real bugs faster than maintainers can triage them. The flip side showed up at QEMU, where someone filed 125 AI-generated bug reports in under 10 minutes, overwhelming a project that doesn't have the staffing to separate signal from noise at that rate. Debian responded by voting to allow generative AI contributions but holding contributors fully accountable for whatever they submit — a middle path that puts the liability where it belongs. [Read more](https://daily.dev/posts/MBw6DVYpM) ## Atlassian's three-month agentic patching run: 120+ vulnerabilities, 95% clean merges Atlassian wired Bitbucket Agentic Pipelines to Jira Automation, a custom dispatcher, and Rovo Dev as the coding agent to automate routine vulnerability patching end to end: a dispatcher groups eligible tickets, the agent fixes code and opens a PR, and a closer verifies deployment before closing the ticket. Over three months one team resolved more than 120 vulnerabilities through 55+ agent-created PRs, with 95% merging on the first pass with no rework needed. The practices that made it work were boring but important — codebase-specific instructions, deterministic human checkpoints, and narrowly scoped access — which is probably the actual lesson here for anyone trying this themselves. [Read more](https://daily.dev/posts/XXtgsat4y) ## Symfony 7.4.18 ships a heavy batch of security hardening This release rejects decompression bombs, blocks cross-authority Host header leaks, refuses cleartext HTTPS proxies, caps RateLimiter burst sizes, rejects malformed login link parameters, and validates webhook signature timestamps for Mailgun, SendGrid, Vonage, Postmark, and Mailomat. That's a dense list of fixes across HttpClient, HttpFoundation, Security, and Mailer/Notifier for one point release, and if you're running Symfony in production it's worth reading the changelog rather than just bumping the version blindly. [Read more](https://daily.dev/posts/25p6ptYsW) --- ## Also notable - **Heretic strips AI safety filters via automated abliteration:** On a 12B Gemma 3 model, Heretic matched manual jailbreak removal while cutting KL divergence from 1.04 to 0.16, meaning far less collateral damage to the model's reasoning. [Read more](https://daily.dev/posts/GHWaDlO16) - **Zcash proof generation drops from 200 seconds to ~2:** Zero-knowledge proof times in Zcash have fallen roughly 100x since a 2014 prototype, a concrete data point for anyone evaluating ZK-based privacy tech as production-viable. [Read more](https://daily.dev/posts/B5QMgS8Cx) - **DeepSec triages 729 files down to a short list via agentic revalidation:** Vercel's open-source scanner ran against flaviocopes.com, generating 504 potential findings that Codex-assisted triage narrowed to a handful of genuine risks by grouping on reachability and root cause. [Read more](https://daily.dev/posts/WI85XSdA6) - **Germany funds Flatpak sandboxing with over €500,000:** The Sovereign Tech Agency's investment targets Flatpak security work specifically, adding to prior funding for GNOME and systemd as part of a broader push to harden the Linux desktop supply chain. [Read more](https://daily.dev/posts/MBw6DVYpM) --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#claude](https://daily.dev/tags/claude), [#symfony](https://daily.dev/tags/symfony) [View this post on daily.dev](https://daily.dev/posts/session-hijackers-drain-claude-accounts-linux-cve-volume-doubles-under-llm-scrutiny-h4x5yvp2b) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/session-hijackers-drain-claude-accounts-linux-cve-volume-doubles-under-llm-scrutiny-h4x5yvp2b","headline":"Session hijackers drain Claude accounts, Linux CVE volume doubles under LLM scrutiny","text":"Anthropic is warning that infostealer malware is hijacking authenticated Claude browser sessions to burn through usage without needing a password or 2FA. Linux kernel CVEs have shot past 1,500 per release, up from around 500, partly because LLM-assisted bug hunters are flooding maintainers with reports. Atlassian shared real numbers from three months of letting agents patch vulnerabilities automatically: 120+ fixes, 55+ merged PRs, 95% clean on the first try. Symfony 7.4.18 lands with an unusually dense batch of security fixes worth reading closely if you're on the framework.","url":"https://daily.dev/posts/session-hijackers-drain-claude-accounts-linux-cve-volume-doubles-under-llm-scrutiny-h4x5yvp2b","datePublished":"2026-08-31T04:19:47.831Z","dateModified":"2026-08-31T04:20:10.287Z","author":{"@type":"Organization","name":"Security Digest","logo":"https://media.daily.dev/image/upload/s--m4ZKB_C0--/f_auto,q_auto/v1779959612/logos/security_digest","url":"https://daily.dev/sources/security_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/security_digest","name":"Security Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Digest","item":"https://daily.dev/sources/security_digest"},{"@type":"ListItem","position":3,"name":"Session hijackers drain Claude accounts, Linux CVE volume doubles under LLM scrutiny"}]} ```