Hackers Are Stealing Claude Tokens via Compromised Sessions

A UK-based AI consultant noticed, on August 4, 2026, that his Claude Max 20x account's token consumption was rising on its own, even when he wasn't working. In the most controlled window he could isolate, usage jumped from 45% to 55% while he was running no task at all: Cowork tasks paused or completed, cloud execution (Dispatch) disabled, and no local Claude Code session active. The TechCrunch report shows he wasn't alone, and the problem has a concrete cause that matters to anyone building software with Claude.

What Happened, According to Anthropic

Grant De Swardt, an independent AI consultant in East Sussex, contacted Anthropic and asked for an itemized breakdown of the usage. The company didn't provide that list, but agreed something was wrong: it suspended the paid account, invalidated all Claude Code sessions and tokens server-side, and refunded £44.49, prorated for the remaining days of the $200/month subscription.

After investigating, Anthropic said it found the culprit in his case: a compromised Claude session key was used to generate unauthorized OAuth tokens for Claude Code. According to what was relayed to the consultant, the account "appeared to have been used by a suspicious third-party service to handle other people's activity," without the company being able to determine how access was obtained. The evidence, they said, was consistent both with credentials/session data taken without his knowledge and with the account being connected to an external service.

In practice: an attacker gained access to the account and silently drained tokens. And since support tracks total usage but not usage broken down by source, even on request, this kind of theft could run for months without being noticed.

Not an Isolated Case: The Vector Is Infostealer Malware

De Swardt posted the experience on Reddit and, after 80 comments, found others in the same situation. One user said their account was "auto-upgraded without consent, with a charge to the card and usage spiking from 0% to 100%" without touching anything. Another saw usage go from 0 to 49% in 12 minutes, having only run a few prompts and a web search. A third reported that their account burned through the maximum token limit every day for three days straight without any use of their own, and filed a report on GitHub, where more people confirmed the pattern.

Two of these users published emails from Anthropic that identified and warned about the theft. The company's message is direct about the attack vector:

We recently became aware of a malicious actor using common infostealer malware to steal Claude login sessions from people's computers, then using those sessions to access accounts and consume their usage.

>

-- Email from Anthropic to affected users, via TechCrunch

Infostealer is the malware category that installs on the machine and steals saved passwords, session data, and login credentials. By capturing the active session, the attacker gets in without needing a password or a second factor: the token is already authenticated. Anthropic stressed that the malware doesn't come from using Claude itself, but from various sources on the web, from infected software to clicked malicious ads.

When it detected suspicious activity, the company logged users out, invalidated existing authorizations, issued some refunds, and warned that the machine might be infected. In De Swardt's case, however, that email was never sent; he says he found no sign of compromise on his computer and says he has no way of knowing how the access was obtained. His account was reactivated after about two weeks, and he ended up migrating to Cursor, for the option to use multiple models, including cheaper open-source options. Asked how users can identify misuse, Anthropic declined to comment.

Why Session Theft Bypasses MFA

The technical point developers need to internalize: session hijacking bypasses strong authentication. Multi-factor authentication protects the moment of login. Once you're in, the server issues a session token (or cookie) representing that already-authenticated session. If an infostealer copies that token from disk or memory, the attacker presents it and passes through the same gate you did, without a password and without MFA, because the barrier has already been cleared.

In the reported case, the aggravating factor is the chaining: a compromised session key was used to generate OAuth tokens for Claude Code. In other words, from a stolen session the attacker derived programmatic access credentials with their own validity. Invalidating the original session doesn't always kill everything generated from it.

What Changes for Those Using Claude in Brazil

If you run automations, agents, or code pipelines backed by Claude, the risk described here applies both to Claude.ai subscriptions and to using Claude Code with OAuth. Some practical takeaways from this episode:

• Treat the dev machine as part of the attack surface. The vector here wasn't Anthropic, it was the endpoint. Session tokens and credentials sit on disk and in memory; an infostealer that gets in through a download or a malicious ad takes everything.
• Rotate credentials and review OAuth authorizations periodically. API keys and Claude Code tokens should have scheduled rotation, not a lifetime one. Review and revoke third-party integrations you don't recognize.
• Monitor consumption yourself. Since support doesn't provide usage broken down by source, setting up your own baseline alert (expected average usage per hour/day) is the practical way to spot an anomaly early, instead of finding out at the end of the month.
• Separate production credentials from your personal environment. Running critical automations on the same account and the same machine you use for everyday browsing increases the chance that a sensitive session gets captured.
• Consider the silent cost. On accounts billed by usage via API, tokens mined by third parties turn into a real invoice. The damage isn't just downtime, it's financial.

What remains unresolved is exactly what bothers the consultant in this account the most: the lack of item-by-item visibility into consumption. Without a tool showing what's spending the tokens, detection depends on the owner noticing a strange number, which, in his view, leaves little room for users to protect themselves. As long as Anthropic doesn't expose that breakdown, the responsibility for watching usage and hardening the endpoint falls on whoever builds with it.