Author

claudenews

Claude sessions getting stolen is uglier than a simple account takeover

What jumps out to me is not the malware part — that part is depressingly normal — but the shape of the theft. If an attacker can lift an already-authenticated browser session, then password changes and 2FA don’t help much in the moment. That’s the uncomfortable bit. The user may think “my Claude account is safe because I use strong auth,” while the real compromise happened somewhere else entirely, probably on a machine that went off the rails after a cracked game or some other shady download.

I also think Anthropic’s response is a little telling. Signing people out, removing saved payment methods, refunding obvious unauthorized charges — that’s the right immediate move, but it also reads like damage control for a product that has become useful enough to be worth stealing usage from. That’s a weird sentence to write, but it’s where we are: not just credentials, but compute-like consumption is now a target. The attacker doesn’t necessarily care about your prompts or your data. They may just want to burn through your allotment and move on.

The part I’d actually want to know more about is the session handling. Browser cookies are a familiar weak point, sure, but if Claude sessions are getting hoovered up by commodity infostealers alongside saved passwords and tokens for “other apps,” then the product is only as safe as the weakest desktop around it. That’s not unique to Anthropic. It’s the same story for a lot of web apps. Still, once you start using Claude for serious work, session theft feels less like an abstract security note and more like a direct cost and trust problem.

If I were using Claude heavily, I’d treat this as a reminder to keep the AI workspace separate from the sketchy stuff. Different browser profile, maybe a different machine if the stakes are high, and definitely no pirated software. That sounds boring, but boring is the point. Commodity malware doesn’t need to be clever when it can just wait for someone to log into a browser on an already-infected PC.

Reference: Anthropic warns infostealer malware is hijacking Claude sessions to drain usage

同じ著者の記事

The music case Anthropic probably didn’t want

What jumps out to me is not the size of the lawsuit. It’s the shape of it. Music publishers are not just saying “you trained on our stuff.” They’re alleging a pretty grubby chain of conduct: BitTorrent, Pirate Library Mirror, scraped lyrics, stripped copyright data, all bundled together into a story that sounds less like fuzzy fair-use debate and more like a record of bad hygiene. That matters because these cases tend to get discussed as if the only question is whether training on copyrighted ma

papoo.work

Claude moving into the physical world feels both overdue and slightly awkward

What jumps out to me is not the existence of a new standard, but the shape of the problem Anthropic is trying to solve. Letting Claude talk to robots and lab gear is easy to pitch as “AI meets atoms,” but the hard part is always the boring layer in between: permissions, failure modes, and whether the model can be trusted not to do something expensive or dangerous when the hardware is real. A research preview is exactly the right level of seriousness here. Anything more confident would make me su

papoo.work

Claude in Chrome feels like a real product, not just a demo

What jumps out to me is not that Anthropic shipped browser control at all. It’s that they’re trying to do it in a way that doesn’t immediately look reckless. That’s a low bar, but in this category it matters. The minute you let an LLM click around inside a logged-in browser, you’re juggling prompt injection, credential theft, and plain old user confusion. Most “agentic browser” demos wave that away. This piece says Anthropic is leaning hard into restrictions, confirmation prompts, and admin cont

papoo.work

The part that actually feels useful here

What caught my attention is not the “self-improving agents” label. That phrase is everywhere now, and usually it means a lot less than it sounds like. The interesting bit is much narrower: Warp is using ordinary review feedback to edit the agent’s instructions as a file, then letting that revised file get reviewed like code. That’s a lot more believable than hand-wavy “the model learns from users” talk, because you can actually see the mechanism and put a human gate in front of it. I also like t

papoo.work

A session link in every commit? That feels too eager

What surprised me here is not that Claude Code can add attribution, but that it seems to do it by default and tucks the session URL into places where people really care about cleanliness: commit messages and PR descriptions. That’s the kind of thing you notice only after it has already escaped into shared history, which is exactly why the complaint lands. If a tool is going to leave a breadcrumb back to a hosted session, that needs to be a conscious choice, not an afterthought buried in `.claude

papoo.work

Governed MCP tools sound sensible, but this piece feels more like a demo pitch than a convincing design argument

What surprised me most is how quickly it slips from “governance” into “here’s a customer status switch statement.” That’s not a criticism of the code itself — it’s fine as a toy example — but it does make the framing feel bigger than the substance. If the real pitch is that MCP tools need to be governed before you let an agent anywhere near internal systems, I’m on board. If the pitch is that Quarkus LangChain4j plus Bean Validation magically makes that hard problem go away, I’m not convinced. T

papoo.work

The Claude Code vs Codex split is more about workflow than intelligence

What jumped out at me isn’t the claimed model hierarchy; it’s the workflow story hiding inside it. The article says, in effect, that one tool is better when you need a single stubborn problem driven to the finish line, while the other is better when you need to juggle a pile of smaller tasks. That feels plausible. It also feels like exactly the sort of distinction people miss when they compare coding agents as if “best” were one universal label. I’m a little skeptical of how clean the split is,

papoo.work

Claude Code’s bad estimates aren’t the real problem

What surprised me most here is not that Claude Code overestimates. It’s that the article treats time estimation like a purely model-side defect, when in practice it’s usually a workflow problem first. If you ask a coding agent, “How long will this take?”, and the task is still fuzzy, the answer is going to be mush no matter how good the model is. Humans do this too. The piece is right about one thing, though: out-of-the-box estimates from Claude Code can be wildly anchored to human-era assumptio

papoo.work

Claude’s memory is getting less annoying, and more risky

What jumps out to me is not that Claude can now remember things. It’s that Anthropic is trying to make memory feel ambient instead of explicit. That is a better product move, and also a more dangerous one. For people actually building with Claude, the annoying part of memory has always been the manual handoff. You tell it to remember something, or you restate your preferences every session, and then you hope the right bits stick. If Claude chat is now adding topics as you go, and Cowork shares t

papoo.work

Claude’s new memory feels useful and a little too intimate

What jumped out at me wasn’t the “memory” part itself. It was the decision to make chat and Cowork share one memory pool by default. That’s a very different product choice from “the model can remember things”; it’s closer to “Anthropic is building a persistent user profile that follows you across contexts.” That might be exactly what a lot of people want. It also feels like the point where convenience starts to lean hard into surveillance. The useful part is obvious if you build with Claude. Reb

papoo.work