Hackers Are Quietly Draining Subscribers’ Claude Tokens, Leaving Users Uncertain and Vulnerable
Table of Contents
You might want to know
Could account session data be stolen without obvious signs on the user’s device?
How can subscribers detect and protect themselves from covert token consumption?
Main Topic
On August 4, Grant de Swardt, an independent AI consultant in East Sussex, noticed unexplained token usage on his Claude Max 20x subscription despite not using the service that day. He then disabled integrations and left the account idle; usage increased again. Unable to account for the consumption, he contacted Anthropic and asked for an itemized breakdown. Anthropic did not provide an itemized log but acknowledged unusual activity, suspended his paid account, invalidated sessions and server-side tokens, and issued a partial refund for the remaining period of a $200-per-month plan.
The suspension disrupted de Swardt’s work. As a solo consultant who builds and deploys agents to automate tasks for small and mid-size businesses, he depends on those agents for a wide range of daily operations such as administration, website updates, and data integration. As he explained, many of his business processes "just run through AI these days," so interruption to the account had immediate operational impact.
Anthropic’s investigation traced the problem to a compromised Claude session key that was used to mint unauthorized Claude Code OAuth tokens. Anthropic told de Swardt that evidence suggested an unauthorized third-party service had used the account to provide activity for other people. The company could not determine how that service had obtained access; it said the pattern was consistent with either stolen credentials/session data or the account being connected to an external service.
In plain terms, a malicious actor obtained access to the account and covertly consumed the subscription’s tokens. Because Anthropic’s support tracks only aggregate usage rather than itemized, line-by-line usage per session or per integration, the theft might have persisted undetected for an extended period even after contacting support. This lack of granular visibility left the user with no clear audit trail to prove what actions caused the billing and usage anomalies.
After posting his experience on Reddit, de Swardt found numerous similar reports. Commenters described abrupt, large jumps in usage and one claimed an account was auto-upgraded and charged without consent; another user reported usage spiking from 0% to 49% in twelve minutes while they had only performed a few prompts and a web search. Other reports described accounts exhausting their daily token caps repeatedly without the account owner initiating the activity.
Some users showed communications from Anthropic that described a specific threat: an infostealer malware campaign that harvests saved session tokens from infected machines and then uses those session cookies or session data to access Claude accounts and consume usage. Infostealers are a class of malware designed to extract credentials, session tokens, and other sensitive data from a compromised system. When Anthropic detected suspicious activity, the company signed affected users out, invalidated authorizations, applied refunds in some cases, and warned users they might be infected with malware.
Anthropic also clarified that the malware did not originate from Claude itself; rather, infostealers can be acquired through many common vectors, including installing compromised software, downloading infected files, or interacting with malicious advertisements. Despite that, Anthropic did not provide de Swardt with an explicit malware warning email, and he reports finding no evidence that his own workstation was compromised. He remains uncertain how the attackers obtained access to his sessions.
De Swardt’s account was eventually reinstated after roughly two weeks, but the experience left him dissatisfied. He cited slow support response and the absence of itemized usage data as major issues and canceled his Claude subscription. He migrated to an alternative (Cursor) that supports multiple models including lower-cost open-source options. In his view, the alternatives perform comparably, and without demonstrable resolution or improved transparency from Anthropic, he feels it unlikely he will return to Claude. He highlighted the lack of tools for users to inspect what is consuming their tokens, concluding that users have very limited means to protect themselves.
Anthropic declined to provide additional public guidance on how users can identify misuse beyond the steps it has taken when suspicious activity is observed. The broader pattern of reports, however, suggests several concerns: 1) account or session-token theft can enable third parties to consume paid resources without immediate detection; 2) aggregate-only usage reporting limits users’ ability to audit and attribute consumption; and 3) infostealer malware remains a persistent and stealthy threat capable of exfiltrating session data from infected machines.
This key insight significantly impacts the understanding of account security: without per-session or per-integration visibility, users and providers alike are blind to who or what is consuming paid AI resources. Granular logs tied to session IDs, OAuth grant records, and integration-level usage would make it considerably easier to detect and remediate unauthorized activity quickly, reduce false positives, and support more targeted refunds and mitigations.
Key Insights Table
| Aspect | Description |
|---|---|
| Cause of theft | Compromised Claude session keys used to mint unauthorized OAuth tokens (likely via infostealer malware). |
| Detection limits | Support provided only aggregate usage; no itemized, per-session breakdown was available to the user. |
| Provider response | Suspended accounts, invalidated sessions, issued partial refunds, and warned some users of malware. |
| User impact | Business disruption for dependent users; loss of trust; some users migrated to alternative platforms. |
| Recommended improvement | Add granular, itemized usage logs, better session-management controls, and clearer guidance when suspicious activity is detected. |
Afterwards...
Moving forward, several technology and policy areas merit attention. On the technical side, platform operators should provide finer-grained telemetry: per-session and per-integration usage logs, OAuth grant histories, and IP/geolocation records for suspicious sessions. These data would empower users to detect anomalies quickly and enable support teams to triage and attribute misuse effectively. Subtle emphasis on secure defaults — such as short-lived session tokens, mandatory multi-factor authentication, and automated detection of high-rate usage patterns — would reduce the window in which stolen credentials can be abused. End-to-end session protection, improved user-facing audit tools, and more aggressive session invalidation workflows are practical next steps.
On the defensive side, users and organizations should treat AI service credentials like any high-value secret: use dedicated machines for sensitive credentials, keep systems patched, run reputable anti-malware software, avoid installing untrusted packages, and enable multi-factor authentication where available. Providers should communicate clearly when they detect suspicious patterns and offer straightforward remediation paths and transparent logs to affected customers.
Finally, research into detecting infostealer behavior, improving client-side protections for session material, and standardizing audit logs across AI platforms would benefit the broader ecosystem. Greater transparency and tooling would help restore user trust and limit the business and financial impacts that follow covert token theft.