On August 4, Grant de Swardt, an unbiased AI guide in East Sussex, UK, observed one thing unusual occurring together with his Claude Max 20x account. He hadn’t been working that day, but his token utilization was climbing.
The subsequent day, he disabled every thing he had connected to Claude and didn’t work with it. Token consumption once more elevated. “Within the clearest managed interval, it elevated from 45% to 55% whereas I carried out no work, scheduled Cowork duties have been paused or accomplished, Dispatch/cloud execution was disabled, and there was no corresponding energetic native Claude Code job,” de Swardt informed TechCrunch.
What was consuming up his token allowance? He had no concept, so he contacted Anthropic and requested for an itemized record. Anthropic didn’t present one, but it surely agreed one thing was off. It suspended his paid account, invalidated all of his classes and server-side Claude Code tokens, and issued him a partial refund of £44.49 for the remaining time on his $200-per-month subscription.
The suspension wreaked havok on his enterprise, he informed TechCrunch. His job is to assist small and mid-size companies arrange brokers — a form of forward-deployed engineer for rent — for duties like routinely loading purchase-order knowledge from emails into the accounting software program.
As a sole proprietor, he depends on brokers all through his entire enterprise, too: each day admin duties, web site design, coding. “Like every thing is simply operating by AI nowadays,” he mentioned.
After investigating, Anthropic informed de Swardt it discovered the perpetrator: A compromised Claude session key was used to mint unauthorized Claude Code OAuth tokens. The corporate informed him the account “appeared to have been utilized by an unauthorized-looking third-party service to deal with exercise for different folks, however they might not decide the way it obtained entry,” he informed TechCrunch. “They are saying the proof is constant both with credentials/session knowledge being taken with out my information, or with the account having been related to an out of doors service.”
In different phrases, a hacker was in a position to receive entry to de Swardt’s account and was covertly siphoning off his tokens. As a result of account assist tracks complete utilization however not itemized utilization, even upon request, this sort of theft might have gone on for months undetected.
He posted his experience on Reddit and after 80 feedback, he found he was not alone. One particular person claimed that their account “was auto-upgraded with out my consent, my bank card received charged, and the utilization shot from 0% to 100% routinely with out me even touching it.” One other noticed utilization go from 0 and to 49 % in 12 minutes, when all that they had used it for was a few prompts and net search.
One Claude person mentioned their account burned by its max tokens every single day for 3 days with out them utilizing it in any respect, and created a Github report about it. Like with the Reddit submit, others customers shared comparable experiences there, too.
Two of them posted emails from Anthropic the place the corporate had — to its credit score — recognized and warned them that their tokens have been being stolen.
“We now have just lately turn into conscious of a foul actor that’s utilizing widespread infostealer malware to steal Claude login classes from folks’s computer systems, then utilizing these login classes to entry Claude accounts and eat their utilization,” the e-mail learn. Infostealers are a kind of malware that installs itself on a person’s pc and steals saved passwords, session knowledge, and login-credentials.
When Anthropic noticed suspicious exercise, it signed the customers out, invalidated present authorizations, issued some refunds and warned them that they could have malware.
The corporate additionally mentioned the malware didn’t come from utilizing Claude itself. Such malware may be picked up from many sources on-line, from downloading contaminated software program to clicking on contaminated advertisements.
Anthropic didn’t ship de Swardt a kind of emails. He insists he discovered no proof that his pc was compromised, and says he nonetheless has no means of figuring out how hackers gained entry.
de Swardt’s Claude account was reinstated after about two weeks. However the problem of getting speedy assist for the matter, plus the shortage of an itemized utilization, soured him on Claude. He cancelled his subscription in favor of Cursor and its skill to make use of a number of fashions, together with extra reasonably priced open-source choices.
In his expertise, these different fashions work in addition to Claude. “It’s not that a lot totally different or higher,” he mentioned, including that he can’t see going again “with out them truly having resolved the problem in any means.” He says Anthropic nonetheless lacks instruments that enables customers to see what’s consuming their tokens. “I don’t assume there’s any means that these folks can shield themselves.”
When requested for info on how customers can establish misuse, Anthropic declined to remark.
Whenever you buy by hyperlinks in our articles, we may earn a small commission. This doesn’t have an effect on our editorial independence.