AI Daily Newsstand: September 1, 2026: Claude Session Hijacking, Tencent Hy4, California AI Bills

There's a thread running through the last 48 hours, and it's about who gets to look inside the box. A stolen browser cookie let strangers look inside paying customers' AI accounts. A cryptographic sandbox let an outside auditor look inside a frontier model without seeing its weights. And a 770-billion-parameter model got its weights published so anyone can look inside for free. Same question, three very different answers.

The weekend itself was quiet on releases, which is normal for the last days of August. The interesting news was about trust.

The Front Page: Nobody Hacked Anthropic, and Claude Accounts Got Drained Anyway

Anthropic spent August 31 cleaning up after a campaign that never touched its servers. Attackers used commodity infostealer malware sitting on customers' own computers to lift active Claude login sessions, then replayed those sessions to get into accounts and chew through paid usage limits. Anthropic force-signed affected accounts out of every session, revoked the stolen tokens, deleted saved credit cards, and refunded the unauthorized charges. BleepingComputer has the timeline, and Help Net Security covered the lockout.

The named strains are boring, and that's the point: Vidar, LummaC2, StealC, RedLine and Acreed on Windows, plus Atomic Stealer on a handful of Macs, per SecurityWeek. None of these are exotic. They're the same off-the-shelf cookie grabbers that have been draining crypto wallets and gaming accounts for years. What changed is that an AI subscription is now worth stealing, because metered inference converts directly into someone else's compute bill. Anthropic's own warning contains the sentence everyone should sit with: signing you out stops the current theft, and it does not remove the malware, so your next session can be taken exactly the same way.

What it means: A session cookie is a signed permission slip that says you already logged in. Steal it and you skip the password and the multi-factor prompt together, which is why "I have MFA on" was no defense here. For anyone running agents, the blast radius is wider than a chat history: the same cookie jar often holds sessions for the tools your agent is wired into. Treat account hygiene as part of the build, not an afterthought, and when you map out an agent workflow, write down which steps hold credentials and how you'd revoke them in a hurry.

Releases & Features

Tencent open-sourced Hy4 preview. The Hunyuan team published weights for a 770-billion-parameter mixture-of-experts model that activates only 49 billion parameters per token, with a context window over one million tokens and an FP8 quantized variant for cheaper serving. It ships under Apache 2.0, which is about as permissive as licenses get. Tencent's announcement is the primary source, and TechNode has the release details. API access runs $0.834 per million input tokens and $2.501 per million output tokens through Tencent Cloud and OpenRouter. On its own internal blind evaluation, Tencent says 163 experts scored the model 2.99 out of 4 across 203 engineering tasks, against 2.92 for GLM 5.3 and 2.94 for Kimi K3. That's a company grading its own homework, and the gap is a rounding error, so wait for independent runs.

The release lane was otherwise quiet. The freshest models on the trackers are still GLM-5.3-Flash from Z.ai and Qwen3.8-Flash-Next from Alibaba, both from August 26. Both are cheap, fast tiers rather than flagships, and that lane is where most real production work quietly lands.

What it means: The pattern is unmistakable. Chinese labs keep publishing weights at frontier scale while Western labs mostly publish prices. You probably won't self-host 770 billion parameters, and you don't need to. What open weights give a small team is bargaining power and an exit: if your provider raises prices or changes terms, a compatible model is one config change away.

In the Lab

Google DeepMind ran what it describes as the world's first double-blind evaluation of a proprietary frontier model. Using Confidential Space, a Google Cloud service that runs code inside a hardware-sealed enclave, an external evaluator tested a Gemini Flash Lite model against secret safety prompts without ever seeing the model weights, while Google never saw the prompts. Partners included the Singapore AI Safety Institute, OpenMined, AVERI and MLCommons, and the test drew on reserved prompts from the AILuminate safety benchmark covering cyberattack, chemical and biological hazard, hate speech and self-harm elicitation. DeepMind's writeup explains the setup, and The New Stack has an outside read.

What it means: Benchmark contamination is the quiet rot in every leaderboard. If test questions leak into training data, a score measures memory instead of ability. Sealing the questions so the lab can't see them is a real fix, and it's the first credible answer to "why should we believe your safety numbers?" One caveat worth holding: this pilot ran on a small, fast model, not on a flagship, and a technique only counts once it's applied where the risk lives.

The Oversight Desk

California's legislature adjourned its 2026 session on August 31 with roughly 30 AI measures on the floor, spanning chatbot safety rules, AI copyright transparency, worker protections against algorithmic management, and a proposed first-in-the-nation AI safety certification commission. The Transparency Coalition's legislative tracker followed the bills through the final weeks, and the National Law Review covers the ones already in force. Whatever survived now waits on the governor's desk.

What it means: Sacramento regulates the companies that build the models, so California rules travel nationally whether other states vote on them or not. Combine that with the EU AI Act's transparency duties, live since August 2, and the compliance floor for anyone shipping an AI product to the public is rising on two continents at once. If you deploy a bot that talks to customers, the disclosure requirement is the cheapest thing on the list to get right, and the most embarrassing to get wrong.

On the Radar

Smaller moves worth a glance, with the sources if you want to go deeper.

• Sony and Warner sued Anthropic, and named two executives personally. Sony Music Publishing and Warner Chappell filed on August 28 in the Northern District of California, naming Dario Amodei and Benjamin Mann as individual defendants alongside the company. Anthropic says it disagrees and will defend itself. TechCrunch.
• Chatbots handled state propaganda better than search summaries did. NPR and NewsGuard put 30 questions built from false narratives pushed by Russia, China and Iran to the major assistants and to search engines. The chatbots pushed back most of the time; the AI summaries at the top of search results did worse. NPR.
• The Claude price hike scheduled for today never happened. Sonnet 5's introductory $2 and $10 per million tokens was supposed to jump to $3 and $15 on September 1. Anthropic made the lower rate permanent instead, which tells you how much pricing pressure the mid-tier is under. Anthropic's pricing docs.
• Tencent is giving Hy4 away free for two weeks. Its WorkBuddy and CodeBuddy products offer no-cost access to the new model for a limited window, which is a cheap way to try a frontier-scale open model without standing anything up. TechNode.

The Bottom Line

The models weren't the story over these two days. Verification was. Anthropic's incident is a reminder that the weakest link in an AI stack is usually the laptop it's opened on, not the model behind it. DeepMind's sealed evaluation is an early attempt to make safety claims checkable by someone with no incentive to flatter them. And Tencent publishing 770 billion parameters means the cheapest form of verification, reading the thing yourself, keeps getting easier. The lesson for the week ahead is unglamorous: audit what holds your credentials, then go build something with the parts that are now free.

Frequently Asked Questions

• How did attackers get into Claude accounts without a password? +
  They stole session cookies, not passwords. Infostealer malware running on a victim's own computer copies the browser cookies that prove you already signed in. Because that cookie represents an authenticated state, replaying it skips both the password and the multi-factor prompt. Signing out everywhere kills the stolen cookie, but it does nothing to the malware that took it, so the cleanup order is remove the malware first, then sign back in. If you want the wider picture on locking down the tools around your agents, start with automating a security stack.
• Should a small team run an open-weight model like Tencent Hy4? +
  Almost never on your own hardware. Hy4 preview has 770 billion total parameters, and self-hosting a model that size costs far more than renting it through an API. What open weights buy a small team is leverage: real competition on price, the option to move providers without rewriting anything, and the ability to audit what you're running. Rent the API, keep your prompts and specs portable, and let someone else own the GPUs. Our guide to hosted AI agents walks through the runtimes that do that for you.
• What is the AI Daily Newsstand? +
  AI Daily Newsstand is BYOBot's daily AI news brief, published every night. It covers the day's model releases, new features and capabilities, research, and oversight news, then tells you what each move means for people building with AI, in plain English and without the hype.