Claude Token Theft: How Hackers Are Draining Paid Anthropic Accounts

On August 4, 2026, UK-based AI consultant Grant De Swardt noticed his Claude Max account burning through tokens while he was not working. After contacting Anthropic, he learned a compromised session key had been used to mint unauthorized OAuth tokens, letting a third party silently consume his $200-per-month allowance. Anthropic has since confirmed the broader attack: infostealer malware is being used to steal Claude login sessions from subscribers' computers, then drain their token allocations.

What happened

Detail	Fact
Incident date	August 4, 2026
Victim	Grant De Swardt, independent AI consultant, East Sussex, UK
Subscription cost	$200 per month (Claude Max 20x)
Refund issued	£44.49 for remaining subscription time
Account suspension length	Approximately two weeks
Attack method	Compromised session key used to mint unauthorized Claude Code OAuth tokens

De Swardt noticed his token usage rising on days he did nothing. In his most controlled test, usage climbed from 45% to 55% while all scheduled tasks were paused, cloud execution was disabled, and no local Claude Code session was active. He contacted Anthropic and asked for an itemized breakdown of what was consuming his tokens. Anthropic did not provide one.

The company did agree something was wrong. It suspended his account, invalidated all active sessions and server-side Claude Code tokens, and issued a partial refund. Anthropic later told him the account had been accessed via a compromised session key that was used to generate unauthorized OAuth tokens, and that an unauthorized third-party service appeared to be using it to process activity for other people.

How the attack works

According to an email Anthropic sent to some affected users, a bad actor is using infostealer malware to steal Claude login sessions from subscribers’ computers. Infostealers are a well-known category of malware that quietly harvest saved passwords, session cookies, and login credentials after installing themselves on a device. Once the attacker has a valid session token, they can access the account without the account holder’s password.

Critically, Anthropic stated the malware does not come from using Claude itself. It can arrive through downloading infected software, clicking a malicious ad, or dozens of other common vectors.

Because Anthropic’s account dashboard shows total token consumption but not an itemized log of which application or session consumed what, a victim has no reliable early warning. Anthropic declined to comment when TechCrunch asked how users can identify misuse.

How widespread is this?

After De Swardt posted on Reddit, the thread attracted over 80 comments from users reporting similar patterns. One reported their account was upgraded without consent, a credit card was charged, and usage jumped from 0% to 100% without them touching anything. Another saw usage go from 0 to 49% within 12 minutes after only a couple of prompts. A third person’s account burned through its full token limit every day for three consecutive days without any action on their part, which prompted them to file a GitHub report. Further reports appeared there too.

Notably, Anthropic proactively emailed some affected users to warn them their tokens were being stolen and that they may have malware. De Swardt did not receive that email, and Anthropic could not confirm how his session was compromised. He says he found no evidence his computer was infected.

Why it matters

This is not a niche problem. High-cost AI subscriptions are now core infrastructure for a growing number of freelancers, consultants, and small businesses. For De Swardt, a sole proprietor whose entire workflow runs through AI agents for admin tasks, coding, and client work, having the account suspended for two weeks caused real business disruption. The theft and the disruption it caused are two separate damage events.

The deeper issue is the lack of observability. If Anthropic cannot provide itemized usage data on request, users have no way to audit what is consuming their allowance, identify a breach early, or prove misuse to their own accountants. That is a meaningful gap for any business treating these subscriptions as professional tools. If you are using AI integrations across your business operations, knowing exactly what each agent and session consumes is not a luxury, it is basic financial hygiene.

This story also fits a wider pattern. As we noted in our coverage of Anthropic’s rising valuation and investor interest, the platform is attracting serious commercial users. More commercial users mean more valuable accounts and a higher payoff for attackers who find a way in.

Our take

The attack itself is fairly standard: steal a session token, reuse it silently, collect the compute. What is not standard is a $200-per-month subscription product that cannot tell you, even after the fact, which process consumed which tokens. That is a product decision, not a technical limitation. Most cloud billing dashboards offer line-item logs as a matter of course.

Anthropic deserves credit for identifying some victims proactively and issuing refunds. But declining to comment on how users can detect misuse is a poor look when the company has already confirmed the attack is ongoing. De Swardt eventually cancelled and moved to Cursor, citing comparable output from other models at lower cost. That outcome, a paying enterprise customer walking away, should focus minds faster than any security advisory.

If you run agents for clients or depend on a high-tier Claude subscription for your business, treat this as a prompt to review your security posture and your invoicing habits.

What to do about it

1. Check your Claude usage dashboard today and screenshot your current token percentage so you have a baseline for comparison.
2. Revoke any third-party OAuth connections you do not actively recognize inside your Claude account settings.
3. Run a reputable malware scan on every device that has accessed Claude, paying particular attention to infostealer signatures.
4. Rotate your Anthropic account password and sign out of all sessions immediately if usage looks abnormal.
5. Contact Anthropic support in writing if you suspect theft, and ask explicitly for any refund and session invalidation.
6. Consider whether a multi-model setup (such as Cursor with open-source fallbacks) reduces your exposure to a single-platform incident.

Until Anthropic adds itemized usage logs, treating your token balance like a bank balance and checking it daily is the only practical early-warning system available.

Source: TechCrunch · AI