Hackers are draining Claude subscriptions — and users have no way to see where their tokens went

On 4 August, Grant De Swardt, an independent AI consultant in East Sussex, UK, noticed his Claude Max 20x usage climbing on a day he wasn't working. He disabled everything connected to the account and tried again. "In the clearest controlled interval, it increased from 45% to 55% while I performed no work," he told TechCrunch — scheduled tasks paused, cloud execution off, no active local session. He asked Anthropic for an itemised list of what was consuming his quota. The company didn't provide one, but agreed something was wrong: it suspended the paid account, invalidated all his sessions and server-side Claude Code tokens, and refunded £44.49 of his $200-a-month subscription.

Anthropic's eventual finding, as relayed to him: a compromised Claude session key had been used to mint unauthorised Claude Code OAuth tokens. The account, he was told, "appeared to have been used by an unauthorized-looking third-party service to handle activity for other people," though the company could not determine how that service got access. Translated: someone was reselling or reusing his subscription, and the evidence pointed either to stolen session data or to an outside connection he was unaware of.

He is not alone. After he posted on Reddit, dozens of others described the same pattern — usage jumping from 0% to 49% in twelve minutes, quotas exhausted daily without the owner touching the product, one account auto-upgraded and charged. A GitHub report drew the same replies. Two users published warning emails from Anthropic, which to its credit had spotted the abuse first: "We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people's computers, then using those login sessions to access Claude accounts and consume their usage." Infostealers are commodity malware that harvests saved passwords, cookies and session data; Anthropic says it isn't coming from Claude itself, and it can be picked up from a bad download or a poisoned ad. The company signed affected users out, killed existing authorisations and issued some refunds. Asked how users can detect misuse themselves, Anthropic declined to comment.

The technical lesson here is not new, but its target is. Nobody broke the model. They stole the session — the same attack that has plagued banking and gaming accounts for two decades, now pointed at a resource that has suddenly become worth stealing. AI compute is the scarce, rationed, expensive commodity of 2026, and weekly usage limits have made every subscription a small bucket of value sitting behind a browser cookie. A stolen session key is now, functionally, a stolen prepaid card.

What should worry Anthropic more than the malware is the accounting. Support can see total consumption but not itemised consumption — not even on request. That means a customer paying $200 a month cannot answer the most basic question a metered service must be able to answer: what did I spend this on? Absent that, theft is invisible until the quota runs dry, and the burden of proof lands on the victim. De Swardt says he found no evidence his own machine was compromised and still doesn't know how access was obtained. His account came back after roughly two weeks, by which point his consultancy — which runs on agents, for himself and his clients — had taken the hit. He cancelled and moved to Cursor, where he can route work across multiple models, including cheaper open-source ones. His verdict on the alternatives: "It's not that much different or better."

Our reading: that last sentence is the expensive part of this story. Frontier labs have spent two years assuming their moat is capability, while customers increasingly discover the switching cost is low and the operational trust is what actually binds them. Billing transparency, session hygiene, incident response and a usage ledger you can audit are not features — they are the difference between a research product and infrastructure a business can stand on. The good news is that this is a solved problem in every other metered industry, and solving it is cheap compared to training a model. The bad news is that it only gets prioritised after enough people leave. As AI moves from a tool you open to an agent that runs continuously on your behalf, the question "who is spending my compute, and on what?" stops being a billing detail and becomes the core security question of the category. Whoever answers it first will keep the customers everyone else is currently annoying.