Hackers are stealing Claude tokens from subscribers

On August 4, Grant De Swardt, an AI consultant in East Sussex, noticed his Claude Max 20x account's token usage rising even though he was not using the service. He disabled integrations and paused scheduled tasks, but usage climbed again the following day. After contacting Anthropic, the company suspended his paid account, invalidated active sessions and server-side Claude Code tokens, and issued him a partial refund of £44.49 on his $200-per-month plan.

Anthropic later told De Swardt its investigation found a compromised Claude session key had been used to mint unauthorized Claude Code OAuth tokens and that the account appeared to be used by an unauthorized third-party service. The company said it could not determine precisely how the session data was obtained, describing evidence consistent with either stolen credentials/session data or an account connection to an outside service.

Other Claude users reported similar unexplained bursts of usage on Reddit and in a GitHub report; examples included accounts being auto-upgraded, unexpected charges, and usage jumping from near-zero to high percentages within minutes. Anthropic emailed some affected customers to warn that a bad actor was using infostealer malware to capture saved login sessions from users’ machines and then use those sessions to access Claude accounts and consume tokens. In response to suspicious activity, Anthropic has signed affected users out, invalidated authorizations, and issued some refunds.

De Swardt said he found no evidence his machine was compromised and that Anthropic did not send him one of the malware-warning emails. His account was reinstated after about two weeks, but he cancelled the subscription and moved to a different product (Cursor) because he felt Anthropic lacked tools to reveal what is consuming tokens. Anthropic declined to provide guidance on how users can identify misuse. The incident highlights a gap: because support records total usage without itemized logs, unauthorized consumption could potentially continue undetected for months.