Hackers steal subscribers' Claude tokens via malware that hijacks login sessions

An independent artificial intelligence consultant based in East Sussex, United Kingdom, detected anomalous behavior in his Claude Max 20x account in early August: token consumption kept rising even though he was not working that day. The following day he disconnected all integrations and stopped using the service entirely, but consumption rose again. As he told TechCrunch, in the clearest control interval usage went from 45% to 55% without him taking any action, with scheduled tasks paused or finished, cloud execution disabled and no active local Claude Code task running.

Faced with the lack of an explanation, he asked Anthropic for a detailed breakdown of the consumption, something the company could not or would not provide. Even so, it acknowledged that something did not add up: it suspended the paid account, invalidated all sessions and the Claude Code tokens hosted on the server, and issued a partial refund of £44.49 for the remainder of the period of a $200-a-month subscription. The suspension hit his professional activity head-on — work focused on deploying AI agents for small and medium-sized businesses, for example to automatically load purchase-order data from email into accounting software — and which, as a freelancer, also depends on these tools for his day-to-day administration, web design and programming.

After investigating, Anthropic told him it had identified the source: a compromised Claude session key was used to generate unauthorized Claude Code OAuth tokens. The company said the account "appeared to have been used by an unauthorized-looking third-party service to manage other people's activity, but they could not determine how it gained access". According to what he was told, the evidence was consistent both with credentials or session data being stolen without his knowledge and with the account having previously been connected to an external service. In other words, someone managed to gain access to the account and was covertly siphoning off tokens. Since Anthropic's support only logs total usage and not a breakdown by activity —not even when expressly requested— this type of theft could have gone unnoticed for months.

He posted his experience on Reddit and, after it drew some 80 comments, discovered he was not an isolated case. One user recounted that his account was "automatically upgraded without my consent, my credit card was charged and usage went from 0% to 100% automatically without me even touching it". Another watched consumption jump from 0% to 49% in just 12 minutes, when his activity had been limited to a couple of prompts and a web search. Yet another user said his account hit the maximum token limit for three consecutive days without using it at all, which led him to open a report on GitHub; there, again, other users described similar experiences. Two of them even shared emails from Anthropic in which the company itself —credit where it is due— had identified and warned that their tokens were being stolen.

The text of those emails, quoted by the affected users, read: "We recently became aware of a malicious actor using common infostealer malware to steal Claude login sessions from people's computers, and then using those sessions to access Claude accounts and consume their usage". Infostealers are a type of malware that installs itself on the victim's machine and steals saved passwords, session data and access credentials; they have no relation to the use of Claude itself, and can be picked up through many common routes, from infected software to malicious ads. When Anthropic detects suspicious activity of this kind, it logs affected users out, invalidates existing authorizations, issues refunds in some cases and warns them that they probably have malware on their machine.

The East Sussex consultant, however, never received one of those warning emails. He insists he has found no evidence that his computer was compromised and maintains that he still has no way of determining how the attackers gained access to his account. His account was eventually restored after about two weeks, but the slowness in getting help and, above all, the impossibility of accessing a usage breakdown ultimately left him disappointed. He cancelled his Claude subscription and switched to Cursor, which lets him alternate between several models, including cheaper open-source options; in his experience, these alternatives perform comparably. "It's not that it's very different or better," he said, adding that he is not considering going back "without [Anthropic] having solved the problem in some way". In his view, the company still lacks tools that let users see what is actually consuming their tokens: "I don't think there's any way these people can protect themselves". Asked by TechCrunch how users can detect misuse of their accounts, Anthropic declined to comment.

The case illustrates an uncomfortable blind spot in the rapid expansion of pay-per-use AI agents: the more tasks are automated and the more is delegated to persistent sessions and access tokens, the larger the attack surface for credential theft, and the less visibility the end user has over their own consumption. The absence of an itemized record —standard in the billing of almost any other digital service— leaves subscribers with no way to audit their own account, and platforms with no clear mechanism to prove, in a dispute, which activity was legitimate and which was not. While the big AI labs compete to launch ever more autonomous features —cloud execution, scheduled tasks, agents that operate without direct supervision— episodes like this suggest that basic account-security and usage-transparency safeguards do not always advance at the same pace as the product's capabilities.