A security consultant in the U.K. watched his Claude Max token allowance climb while he was not using the service. The consumption went from 45% to 55% during a controlled test where he disabled every integration, paused all scheduled tasks, and did not touch Claude at all. The tokens were being stolen, and neither he nor Anthropic could immediately determine how.
How the Theft Works
Grant De Swardt, an independent AI consultant in East Sussex, discovered the unauthorized usage on August 4. His Claude Max 20x subscription, which costs $200 per month, was being drained by someone else. He contacted Anthropic and asked for an itemized list of token consumption. Anthropic did not provide one, but agreed something was wrong. The company suspended his account, invalidated all session and server-side Claude Code tokens, and issued a partial refund of £44.49.
After investigating, Anthropic told De Swardt that a compromised session key had been used to mint unauthorized Claude Code OAuth tokens. The company said his account "appeared to have been used by an unauthorized-looking third-party service to handle activity for other people, but they could not determine how it obtained access." The evidence was consistent with credentials or session data being stolen without his knowledge.
The incident was not isolated. De Swardt posted his experience on Reddit and within 80 comments discovered multiple other users had encountered the same problem. One reported their account was auto-upgraded without consent, with their credit card charged and usage jumping from 0% to 100% without any interaction. Another saw usage climb from 0% to 49% in 12 minutes after using only a couple of prompts and a web search. A third said their account burned through maximum tokens every day for three days without them using it at all, and filed a GitHub report documenting the issue.
Two of the affected users shared emails from Anthropic where the company explicitly identified the cause: infostealer malware. These emails explained that a bad actor was using common infostealer malware to steal Claude login sessions from users' computers, then using those sessions to access accounts and consume usage. Anthropic signed the affected users out, invalidated existing authorizations, issued refunds, and warned them that their computers might be compromised.
What Anthropic Did and Did Not Do
Anthropic's response varied across affected users. The two users who received warning emails were told the malware did not come from using Claude itself. Infostealers can be acquired from many sources: downloading infected software, clicking on malicious ads, or visiting compromised websites. The company positioned this as a user-side security problem, not a platform vulnerability.
De Swardt did not receive one of those warning emails. He insists he found no evidence that his computer was compromised and says he still has no way of determining how hackers gained access. His account was reinstated after approximately two weeks. When asked for information on how users can identify misuse, Anthropic declined to comment.
The lack of itemized usage tracking is a structural problem. Claude tracks total token consumption but does not break it down by session, request, or time period. Even upon request, Anthropic cannot tell a user which specific requests consumed their tokens. This means a theft like De Swardt's could continue for months without detection, because the only signal is a gradually increasing usage percentage with no way to identify the cause.
The absence of granular usage data also makes it impossible for users to protect themselves proactively. Without seeing which requests are consuming tokens, there is no way to identify unauthorized access before it drains the allowance. The monitoring gap turns a security incident into an ongoing financial loss.
What It Cost
For De Swardt, the impact went beyond the subscription fee. His business depends on Claude. As an AI consultant helping small and mid-size businesses set up agents for tasks like automatically loading purchase-order data from emails into accounting software, Claude is his primary tool. The account suspension disrupted client work, and the two-week reinstatement period created additional downtime.
As a sole proprietor, he relies on agents across his entire operation: daily admin tasks, website design, coding. "Like everything is just running through AI these days," he told TechCrunch. The token theft did not just cost him $200. It cost him billable hours and client trust.
After reinstatement, De Swardt cancelled his Claude subscription and moved to Cursor, which supports multiple models including more affordable open-source options. In his experience, these other models perform comparably to Claude. "It's not that much different or better," he said, adding that he cannot see returning "without them actually having resolved the issue in any way."
The Broader Problem
The incident exposes a vulnerability class that most AI providers have not addressed. Session tokens and API keys are the new passwords, but the infrastructure for managing them lags behind. Most providers, including Anthropic, do not offer granular usage monitoring. Users cannot see which requests consumed their tokens, when those requests occurred, or from which IP address they originated.
Infostealer malware is a known and growing threat. It targets session cookies, saved passwords, and authentication tokens across all services, not just AI platforms. But AI subscriptions are particularly attractive targets because they offer high-value compute access. A stolen Claude Max token provides enough capacity to run automated tasks, process large volumes of data, or power other applications at someone else's expense.
The response from AI providers has been inconsistent. Anthropic identified and warned some affected users, invalidated compromised sessions, and issued refunds. But the company declined to provide guidance on how users can detect misuse, did not implement usage monitoring that would make detection possible, and took two weeks to reinstate De Swardt's account. For a service that many businesses depend on for daily operations, that response time is insufficient.
Users can take some precautions: enable multi-factor authentication on AI accounts, avoid storing session tokens in browser extensions or shared environments, and monitor subscription billing for unexpected charges. But the fundamental problem remains that AI providers do not give users the visibility they need to detect and respond to token theft in real time. Until that changes, the risk is borne entirely by the subscriber.