Hackers drain Claude accounts with stolen sessions and Anthropic doesn't tell users what their tokens are spent on

By Zendoric · September 9, 2026.

On August 4, Grant de Swardt, an independent AI consultant in East Sussex (United Kingdom), noticed that his Claude Max 20x account —the $200-a-month plan with Anthropic's highest usage limit— kept burning through tokens even though he wasn't working. The next day he disconnected all his integrations and stopped using the tool; usage, he told TechCrunch, still climbed "from 45% to 55%" with scheduled tasks paused, cloud execution disabled and no local Claude Code process running.

Anthropic confirmed something was wrong: it suspended the account, invalidated all sessions and the server-generated Claude Code tokens (the mechanism that lets an application stay authenticated without asking for the password every time) and refunded £44.49 for the unused portion of the month. As the company itself explained to de Swardt, a compromised session key was used to generate unauthorized Claude Code OAuth tokens, and the account "appeared to have been used by an unauthorized-looking third-party service to manage other people's activity", although Anthropic said it could not determine how the access was obtained. Neither the company nor de Swardt —who says he found no malware on his machine— has been able to explain where the theft came from.

It is not an isolated case. De Swardt shared his story on Reddit and, among nearly 80 comments, similar accounts surfaced: an account that "self-upgraded" its plan without consent and charged the user's card, with usage jumping from 0% to 100% without anyone touching anything; another that went from 0% to 49% in 12 minutes after a couple of prompts; another that hit the maximum limit three days running, prompting its owner to open a report on GitHub. Two more users shared an email from Anthropic that did warn them explicitly: "we have detected a malicious actor using common infostealer malware to steal Claude login sessions from people's computers, and then using those sessions to access accounts and consume their usage".

An infostealer is a type of malware that installs itself on the victim's computer —according to the source, it can be picked up in many ways, from downloading infected software to clicking on infected ads, not from using Claude— and steals saved passwords, session data and access credentials. With a stolen session, the attacker doesn't need the password: they impersonate the legitimate user and burn through their token allowance as if it were their own work. In Anthropic's favor, the company did detect the suspicious activity in several of these cases, logged the affected users out, invalidated the authorizations and offered partial refunds.

But when TechCrunch asked it to explain how users can identify the abuse on their own, Anthropic declined to comment. That is the underlying problem: Claude's support logs total usage, but does not break it down by task or by session, so a theft of this kind can go unnoticed for weeks or months before an alarm goes off —if it goes off at all. De Swardt, who uses Claude agents to run much of his business (from uploading purchase orders to programming his website), ended up canceling his subscription after nearly two weeks with the account suspended and migrated to Cursor, which lets him switch between several models, including cheaper open-source ones; in his experience, they perform just as well.

Two things are worth separating. Anthropic did not build the infostealer or install the malware: primary responsibility lies with whoever distributes that software and with each user's security hygiene. But the product design is its responsibility, and it fails at the most basic requirement of any system that bills by consumption: there is no way to audit in real time which agent, which task or which session is eating the allowance. It is the same asymmetry we are already seeing in the agent governance layer emerging across the industry: as AI stops being a chat and starts executing tasks autonomously and continuously —Cowork, Dispatch, cloud execution—, the credentials to those accounts become an asset as valuable as a banking password, and the cybersecurity sector already treats them that way. Anthropic is one step behind its own users.

In the short term, this kind of friction is the toll of an adoption curve moving faster than the trust infrastructure that supports it: accounts running entire businesses, with no observability or traceability, are a perfect target and a legitimate reason for distrust —de Swardt is not a casual user, he makes a living from these tools and even so he felt defenseless. But the answer is not to slow down the adoption of agents; it is to mature, in parallel, the identity, audit and spending-control layer that underpins them, just as online banking took years to build its own fraud alerts. If AI is really going to handle the admin, the purchasing or the accounting of millions of small businesses —the kind of repetitive work that, solved well, frees up time for what really matters—, it will have to earn the same level of trust we demand of a bank today. That work is not done yet.