AI News Briefing — Infostealer malware hijacks Claude login sessions

Coding agents

• [2026-08-30] Anthropic emailed Claude users whose login sessions were hijacked off their own machines by infostealer malware — Vidar, LummaC2, StealC, RedLine and Acreed on Windows, Atomic Stealer on macOS. A stolen session cookie is already an authenticated session, so it walks past the password, MFA and SSO alike. The tell Anthropic offered: limits that refilled and then drained while you weren’t using Claude. It is revoking sessions, stripping saved payment methods and refunding charges it identifies as unauthorised. Signing out does nothing about the malware that took the cookie. (source)

  Claude is where this got noticed, not where it happened. A stealer sitting on the machine has no reason to stop at one vendor’s cookie jar, so revoking Claude sessions is the smallest part of the cleanup.

• [2026-08-31] OpenClaw 2.0 shipped as v2026.8.1. Sessions can now run on a paired device or a cloud worker with the workspace travelling along, and an agent asks for a secret through a masked prompt rather than putting the value in the chat. Automation permissions are granted for one exact operation, then inspectable and revocable afterwards. Upgrading is not free: the OpenProse plugin and OpenAI route migrations are breaking, and openclaw doctor --fix rewrites the config. (official)

  Per-operation grants change what a permission is — not a checkbox somebody widened once, but a record you can read back and take away afterwards.

  For Software Developers: A long-running session now survives the machine it started on: pair a device or hand it to a cloud worker and the workspace goes with it. Needing a secret mid-run stops meaning pasting a key into a transcript you will scroll back through later.

MCP

• [2026-08-30] Cloudflare wired Workers AI, Vectorize, R2 and Browser Run into a single retrieval service, AI Search, and exposed it at /mcp and /search — endpoints that need no deployment and, as shipped, no authentication. A discovery mode crawls a site with no sitemap, and one query can span several instances. Embedding and re-ranking are free on Workers AI models, answer generation bills by model, and everything is free through the beta. (source)

  An endpoint nobody has to deploy is also an endpoint nobody has to authenticate to — until you put a gateway in front, what you index is what an anonymous caller can retrieve. Beta-free pricing is a bill nobody has seen yet.

  For Solution Architects: Workers AI, Vectorize, R2 and Browser Run behind one service is the retrieval stack you would otherwise assemble and keep in sync yourself, and one query spanning several instances is federation you would normally write. Embedding and re-ranking are free; generation is where the model bill lands.

Agent frameworks & interop

• [2026-08-30] Security architect Ravindra Annam argues the agent gateway is the control teams reach for first and are least equipped to run, because the identity and attribution layer it sits on mostly isn’t there. His alternative is runtime trust: check each proposed action against the original objective, watch tool and API patterns for drift, issue short-lived permissions from runtime context, and put a person in front of high-impact calls. He anchors it to NIST SP 800-207, OWASP GenAI and MITRE ATLAS. (source)

  Gateways get bought first because they can be bought; an identity layer for agents is a project nobody has budget for. Two pieces of his list are buildable without waiting on it — short-lived credentials scoped from runtime context, and a human gate on the calls you already know are high-impact.

Practice & craft

• [2026-08-30] Simon Willison read OpenAI’s documentation for ChatGPT Work and came away arguing the company explains what it is for rather than what it does. What it does: run code with full internet access, drive headless Chrome, keep a filesystem at /workspace/scratch across sessions, orchestrate sub-agents, run prompts on a schedule, and load 44 skills. Private data, untrusted content and an exfiltration path in one process is the lethal trifecta, and he names it here. (source)

  Documentation that explains what a product is for, and not what it does, leaves whoever has to secure it reconstructing the capability list from someone else’s blog post.

  For Security Engineers: Full internet access, headless Chrome and a scratch filesystem that persists between sessions, all in one process, is a threat model you can write down today — untrusted page content reaching company data with an outbound path already open. Scheduled prompts extend that to runs nobody is watching.

Teaching & learning

• [2026-08-31] JetBrains is retiring the Teacher Pack for Bootcamps. Applications close October 1; anything approved by September 30 carries student coupons good for six months, and every bootcamp coupon plus the graduation discount expires April 1, 2027. JetBrains points to its other education programmes — Teacher Pack for Individuals or Classrooms, the Course Creators Program, the Student Pack — but those key off accredited institutions, which is the thing a bootcamp is not. (official)

  A bootcamp with an autumn cohort should file before September 30 and bank the six months; after that everything here is a countdown to April 1, 2027, when coupons already issued stop working too.

Watch list

• Nvidia and Hugging Face, five days without a filing. The $12.9 billion figure still rests on reporting neither company will comment on, and Nvidia’s most recent 8-K is the August 26 results filing. A filing settles this; further coverage will not.

  A deal this size becomes an 8-K when it is signed, not when it is agreed, so five quiet days rule out less than they look like they do.

• OpenAI’s Cursor shutoff on November 12. Nothing has moved since the notice. The signal arrives before the date rather than on it: whether Cursor quietly reorders its model picker away from OpenAI defaults.

  Ten weeks out, the only observable move is a defaults change nobody announces — worth glancing at the picker now and then rather than waiting for a statement on the day.

• Z.ai’s security review for hosts above $10 billion in revenue. Three days in, still no published process, contact or turnaround time. The clause gets priced the first time a large host completes one and says so publicly.

  Three days is not slow for a legal process, but a contact address and a turnaround time are the cheap half, and their absence is what keeps the clause unpriceable.

• Mistral’s Knowledge Connectors switch off today. Whether disabling a connector destroys its index went unanswered through the entire re-index window, so this item retires as planned — an answer arriving now would land after the fact.

  Nothing resolves here; the item just runs out of runway. Anyone who skipped the re-index window finds out today what disabling a connector actually did.