In short
Hackers are reportedly stealing Claude login sessions and draining subscribers’ token allowances without their knowledge. Anthropic says infostealer malware is behind the attacks, but some users say they still cannot tell how their accounts were accessed.
- A UK consultant said his Claude account burned tokens while he was offline.
- Anthropic told some users that infostealer malware stole Claude sessions and drove unauthorized usage.
- The company appears to lack itemized token reports, making suspicious activity hard to diagnose.
- Several other users have reported similar unexplained spikes in usage and billing issues.
- The episode highlights growing security risks for paid AI accounts and agent workflows.
Hackers are stealing Claude usage from paying subscribers by hijacking login sessions and burning through tokens without the account owners realizing it. The problem matters because Anthropic’s support tools do not provide itemized usage breakdowns, leaving some users unable to tell whether their spend is legitimate or the result of unauthorized access.
That is the unsettling conclusion reached after one UK consultant noticed his Claude Max account consuming tokens while he was offline, then found that other users were reporting similar unexplained usage patterns across Reddit and GitHub.
How one subscriber noticed something was wrong
Grant de Swardt, an independent AI consultant based in East Sussex, England, first spotted the anomaly on August 4 when his Claude Max 20x account showed rising token use even though he had not been working.
The next day he tested the account more deliberately. He disconnected the tools and services he had linked to Claude, paused his normal workflow, and avoided using the system. Despite that, the meter kept moving upward.
In the most controlled period, de Swardt said usage climbed from 45% to 55% even though he was not actively working, his scheduled tasks had been paused or finished, cloud execution was off, and there was no matching local Claude Code session running.
At that point, he asked Anthropic for a detailed record of what had consumed the account’s tokens. He says the company did not provide an itemized breakdown, but it did agree that something was abnormal. Anthropic suspended the paid account, revoked sessions and server-side Claude Code tokens, and later issued a partial refund of £44.49 on the roughly $200 monthly plan.
For a solo consultant whose business depends on AI tools, the disruption was more than an inconvenience. de Swardt uses agents to automate tasks such as moving purchase-order information from email into accounting software. He also relies on AI for administrative work, coding, and web design.
He described his business as deeply dependent on AI systems, saying nearly everything he does now flows through them in some form.
What Anthropic said happened
Anthropic later told de Swardt that the issue appeared to involve a compromised Claude session key that was used to generate unauthorized Claude Code OAuth tokens. In plain English, a third party seems to have gained access to an active login session and used it to consume the subscriber’s allowance.
The company also told him that the account appeared to have been used by an unauthorized third-party service to process activity for other people, though it could not say exactly how access had been obtained. Anthropic’s explanation pointed to two possibilities: stolen credentials or session data, or a legitimate connection to an outside service that the user may not have fully understood.
That ambiguity is part of the problem. If account support can only show total consumption, rather than a line-by-line breakdown of what used the tokens, a subscriber may not discover abuse quickly — or at all.
Why stolen Claude tokens can stay hidden
The reason this type of theft is difficult to spot is simple: token usage is usually summarized, not itemized, for users. If a hacker is quietly draining tokens in the background, the owner may only see that the allowance is disappearing faster than expected.
That creates a particularly frustrating scenario for AI power users, freelancers, and businesses that run agents continuously. A token spike could be caused by a real project, a misconfigured workflow, a model loop, or outright theft. Without detailed logs, distinguishing among those possibilities is difficult.
In de Swardt’s case, he says the account problem persisted long enough to damage his business operations. He also says he had no clear way to determine where the access breach began.
How hackers are getting in
Anthropic says it has identified a broader campaign involving infostealer malware, which is designed to harvest passwords, browser data, saved sessions, and other credentials from infected devices.
In emails shown to some users, the company said it had recently learned that a bad actor was using common infostealer software to steal Claude login sessions from victims’ computers and then using those sessions to access accounts and spend their usage.
Once suspicious activity is detected, Anthropic said it signs users out, invalidates authorizations, and issues refunds where appropriate. It also warns affected users that their machines may be infected.
Importantly, Anthropic said the malware is not caused by Claude itself. Infostealers are typically distributed through a wide range of unrelated channels, including malicious downloads, compromised websites, or infected advertisements.
What is an infostealer?
An infostealer is malicious software that quietly copies sensitive data from a device. That can include logins, cookies, browser-stored passwords, session tokens, and other authentication material that lets a thief impersonate the victim without needing the actual password.
Because many services now use persistent sessions, a stolen token can be more valuable than a password. If the session is still active, an attacker may be able to enter the account without triggering immediate suspicion.
Why de Swardt’s case raised fresh concern
De Swardt says Anthropic never sent him the same malware warning that some other users received. He also says he found no evidence that his own computer had been compromised, leaving him without a clear explanation for how the intrusion occurred.
That uncertainty is part of what frustrated him most. After the company suspended the account, he was unable to work normally for roughly two weeks while the issue was sorted out. Eventually, the account was restored, but by then his trust in the service had taken a hit.
He ultimately canceled Claude and switched to Cursor, a coding environment that can route requests across multiple models, including lower-cost open-source systems. In his view, the alternatives are good enough that the risk and inconvenience of staying with Claude were no longer worth it.
He said he does not see a reason to return unless the company fixes the issue in a meaningful way and gives users a better way to inspect what is consuming their tokens.
What other users reported
Once de Swardt posted about the issue on Reddit, he began hearing from other Claude subscribers who described strikingly similar experiences. Several said they saw their token use jump sharply even when they had not been using the account much — or at all.
Among the examples he collected were claims that an account had been upgraded without permission and charged to a credit card, followed by a jump from zero to full usage; another user who said their balance climbed from 0% to 49% in about 12 minutes after only light interaction; and a separate user whose account appeared to burn through the maximum allotment for several consecutive days without any activity.
One of those users even created a GitHub issue to document the behavior. Other commenters there reportedly described the same sort of unexplained consumption.
Two users posted emails from Anthropic warning them that their sessions had likely been stolen. Those notices suggested the company had identified suspicious activity and acted to shut down access.
Why this matters for AI subscribers
The issue goes beyond one consultant’s account. As more people pay for AI subscriptions to power coding, support workflows, research, and automation, the value of a session token rises. A stolen session can cost a user money, time, and in some cases business continuity.
This is especially true for people using expensive plans or agentic workflows that can run unattended. If a model is executing tasks on behalf of a user, a hijacked account may continue generating usage until the allowance is exhausted.
That makes visibility a security feature, not just a billing feature. Without clearer audit tools, users may not know whether their account is overactive because of a bug, an integration problem, or a breach.
What users can do now
Security experts generally recommend a few practical steps for anyone worried about stolen AI sessions:
- Review connected apps and revoke anything unfamiliar.
- Change passwords and enable stronger authentication where available.
- Check for signs of malware on the device used to access the service.
- Log out of all sessions from account settings when possible.
- Monitor account activity closely after any unusual token spike or billing change.
Those steps may not solve every case, but they can reduce the chance that a stolen session continues to be abused.
Can users see exactly where Claude tokens go?
Not in the way many subscribers would like. De Swardt says the absence of itemized usage reporting is the core reason the problem is so hard to diagnose, and he believes Anthropic still does not provide enough transparency for customers to investigate suspicious activity on their own.
That lack of detail matters because AI spend can rise for many reasons. A long prompt, a looping agent, background tasks, or a compromised account can all produce the same basic symptom: a faster-than-expected drop in available tokens.
Anthropic declined to explain how users can identify misuse when asked for guidance, leaving the company’s current detection and support process largely opaque to the public.
Timeline of the Claude token theft reports
The sequence below shows how the problem unfolded for de Swardt and how similar complaints surfaced soon after.
| Date | Event | Significance |
|---|---|---|
| August 4, 2026 | de Swardt notices token usage rising while he is not working | First sign that the account may be compromised |
| August 5, 2026 | He disables connected tools and repeats the test | Usage still climbs despite no active work |
| Early August 2026 | Anthropic suspends the account and refunds part of the subscription | Company confirms abnormal behavior |
| Following days | de Swardt posts about the issue on Reddit | Other users report similar unexplained token losses |
| Within about two weeks | The account is reinstated | Access is restored, but trust is damaged |
| Afterward | Anthropic tells some users their sessions were stolen by infostealer malware | Suggests a broader credential-theft campaign |
Comparison: normal usage, a bug, or theft?
For users trying to interpret sudden spikes, the differences are often subtle. The table below outlines the most likely explanations and what usually distinguishes them.
| Possible cause | Typical signs | Why it is hard to spot |
|---|---|---|
| Heavy legitimate use | Token growth matches active work or long-running tasks | Still looks like rapid consumption if the workload is complex |
| Workflow misconfiguration | Agents loop, repeat, or reconnect too often | May appear as normal automation unless logs are granular |
| Compromised session | Usage rises when the owner is inactive | No itemized report may make the source invisible |
| Malware on device | Unexpected sign-ins, session theft, or password changes | Victim may not notice until billing or account alerts appear |
Why Anthropic’s response matters for the AI industry
This episode highlights a growing challenge for AI subscription businesses: as accounts become more valuable and more automated, support systems and security practices have to mature just as quickly.
Users are increasingly building business-critical workflows on top of model access, which means account transparency is no longer optional. If a user cannot see what is driving token burn, it becomes harder to troubleshoot workflows, verify spending, or detect fraud.
It also raises a broader question for the industry about responsibility. When a paid AI account is compromised, users need fast support, clear diagnostics, and a way to tell whether the problem was caused by a device infection, a third-party integration, or something else entirely.
For now, the practical lesson is stark: anyone relying on AI subscriptions for serious work should treat login sessions like financial accounts — because in effect, that is what they have become.
What happens next?
Anthropic has not publicly laid out a user-facing method for identifying misuse, and it declined to comment further when asked about detection tools. That leaves subscribers largely dependent on support tickets, community reports, and their own testing when token behavior looks suspicious.
Meanwhile, the reports on Reddit and GitHub suggest that de Swardt’s experience may be part of a broader pattern rather than an isolated oddity. Whether the root cause is malware, compromised sessions, or poorly understood integrations, the takeaway is the same: unauthorized token consumption is real, and it can be expensive.
For some users, that uncertainty will be enough to rethink whether a single-model subscription is still the safest option. For others, it may prompt a closer look at browser hygiene, connected apps, and the security of the devices they use to reach these tools.
Either way, the episode is a reminder that AI access is now a valuable asset — and one that attackers can monetize quietly if the right protections are not in place.
Frequently asked questions
How are hackers stealing Claude tokens?
Hackers are reportedly stealing Claude tokens by compromising login sessions, often through infostealer malware that grabs browser cookies or session data. Once they have a valid session, they can access the account and consume usage without needing the password.
Can Claude users see itemized token usage?
Claude users do not appear to get a detailed, itemized breakdown that clearly shows what consumed every token. That makes it difficult to tell whether a spike comes from normal work, a misconfigured workflow, or unauthorized access.
What did Anthropic do when it detected suspicious activity?
Anthropic said it signed affected users out, invalidated authorizations, and refunded some charges where appropriate. In at least some cases, it also warned customers that their devices may have been infected by malware.
Was de Swardt’s computer confirmed to be infected?
No, his computer was not confirmed to be infected. de Swardt says he found no evidence of compromise on his own device, and he says Anthropic never gave him the same malware warning that some other users received.
Why does this matter for AI subscribers?
This matters because AI subscriptions are increasingly tied to business workflows, coding, and automation. If an account is compromised, a user can lose money, miss work, and struggle to prove whether the usage was legitimate.
