Anthropic Warns Hackers Are Stealing Claude Tokens From Subscribers

Anthropic has warned affected users that hackers are stealing Claude tokens from subscribers, even while those subscribers are not working. The warning follows reports of usage limits draining without corresponding activity. In one documented case, a user watched his usage rise by 10 percentage points during a controlled period with his Claude tasks disabled.

The incident points to stolen login sessions, not a compromise of Anthropic’s models. Infostealer malware can copy authenticated session data from an infected computer. Attackers can then reuse that data to enter an account without completing a normal login.

That distinction matters, but it does not make the problem minor. Claude subscriptions now support coding, research, administration, and agent-based work that continues beyond a single chat. Persistent access makes these workflows convenient. It also gives a stolen session more time and more valuable resources to exploit.

The central conflict is therefore larger than one malware campaign. AI providers want their assistants to remain available across browsers, computers, command-line tools, and cloud tasks. Users also need immediate visibility and reliable containment when one of those access paths is stolen.

What Changed When Claude Usage Increased by Itself

The clearest evidence came from usage that continued rising after the subscriber stopped every known Claude task.

On August 4, independent AI consultant Grant de Swardt noticed unexpected activity in his Claude account. He had not been working, but the account’s usage allowance was still declining. The next day, he tried to isolate the cause by disabling connected activity and avoiding Claude entirely.

During one controlled interval, his usage increased from 45 percent to 55 percent. Scheduled Cowork tasks were paused or completed. Cloud execution was disabled, and no matching local Claude Code task was active.

De Swardt described the unexplained consumption during a usage investigation. He also asked Anthropic for an itemized record showing what had consumed the allowance. According to his account, the company did not provide that level of detail.

Anthropic instead suspended the paid account, invalidated active sessions and server-side Claude Code tokens, and issued a partial refund. That response stopped the immediate activity, but it also interrupted de Swardt’s work.

His business depends on AI agents for coding, website work, administration, and customer projects. He helps smaller companies automate processes such as moving purchase-order information from email into accounting systems. Losing access therefore affected more than recreational chatbot use.

Anthropic later told him that a compromised Claude session key had been used to create unauthorized Claude Code OAuth tokens. OAuth tokens are credentials that let an approved application access an account without repeatedly requesting the user’s password.

The company reportedly found activity consistent with an unauthorized third-party service handling requests for other people. However, it could not determine exactly how the outside service had obtained access.

Anthropic offered two possible explanations, according to de Swardt. Credentials or session data might have been taken without his knowledge. Alternatively, the account might have been connected to an outside service that retained access.

Those explanations identify a likely access path, but they leave the original compromise unresolved. They also show why unexplained AI usage is harder to diagnose than an ordinary password reset.

A subscriber sees the percentage consumed, but that figure does not necessarily identify the responsible device, client, session, or task. Local Claude Code logs cannot explain activity originating from a browser, another computer, or an unauthorized remote client.

The word “tokens” can also create confusion. A token is a small unit of text processed by an AI model, but subscribers usually encounter tokens indirectly through usage limits. In this incident, the visible symptom was depleted subscription capacity rather than a readable ledger of individual model requests.

Other users subsequently described similar patterns on Reddit and GitHub. These reports remain individual claims, and they do not establish a precise victim count. However, messages shared by some users included warnings that Anthropic had identified suspicious access.

That vendor warning changed the story. Unexplained usage was no longer only a billing complaint or a possible software bug. Anthropic was attributing at least some cases to stolen sessions and active malware.

Why Hackers Are Stealing Claude Tokens From Subscribers

A stolen Claude session turns somebody else’s subscription into an authenticated pool of AI computing capacity.

Anthropic told affected users that a bad actor was using common infostealer malware to steal Claude login sessions. The attacker then used those sessions to access accounts and consume their available usage.

Infostealers are malware programs built to collect valuable information from a computer. Their targets can include browser cookies, saved passwords, cryptocurrency wallets, autofill records, and application credentials. An authenticated AI session is another reusable asset inside that collection.

The malware does not need to defeat the Claude model or break Anthropic’s central infrastructure. It targets the endpoint where the subscriber already completed authentication. That endpoint might be a personal laptop, a work computer, or a browser profile containing an active session.

This attack path can bypass the moment when multifactor authentication normally intervenes. Multifactor authentication protects a new login by requiring another proof of identity. A copied session can appear to continue an authentication event that already succeeded.

That does not mean every stolen session defeats every security control. Providers can evaluate device information, location, network behavior, and request patterns. They can also revoke suspicious credentials. The campaign shows that detection and revocation did not always happen before usage disappeared.

According to the affected-user notice, Anthropic observed a recognizable symptom. Usage limits appeared to refill and then drain while the owner was inactive. The company responded in detected cases by signing users out and invalidating authorizations.

A separate malware warning reported that Anthropic also removed saved payment methods and refunded charges it classified as unauthorized. The company identified several Windows infostealers and one Mac-focused family in its investigation.

Anthropic stressed that signing out stops the stolen session but does not remove the malware. If the infected device remains compromised, a fresh session can be stolen after the user signs in again.

That sequence explains why changing one password might not solve the problem. The user can replace an account credential, create a new session, and unknowingly expose that new session to the same malware.

Attackers have a direct economic incentive to collect AI access. Model usage can support coding, automated content production, data processing, model extraction, and other high-volume tasks. Stolen capacity moves the cost and account risk onto the victim.

A gray market has also developed around discounted access to commercial AI models. Some services combine promotional credits, fraudulent accounts, shared subscriptions, or unauthorized credentials behind compatible endpoints. Customers send prompts to the intermediary without necessarily knowing which account funds the requests.

Security researchers cited in reporting about this market found services that pooled access across accounts. Such infrastructure provides a plausible destination for stolen capacity, although it does not prove that every affected Claude account fed the same operation.

This distinction should remain clear. Anthropic reportedly observed an unauthorized service using de Swardt’s account for activity involving other people. The public evidence does not identify the operator, its customers, or the full commercial arrangement.

The incident is still consistent with a familiar cybercrime model. Malware operators steal reusable credentials, brokers organize them, and downstream users consume the stolen resource. What changed is the resource being monetized.

Passwords once opened email or banking accounts. Browser cookies later became valuable because they could preserve access after login. Now, AI sessions can expose costly computation, connected tools, stored context, and workflows that act across other services.

Persistent AI Sessions Create a New Security Tradeoff

Claude’s cross-device convenience increases the value of every authenticated session and raises the cost of weak containment.

Claude can operate through its website, desktop applications, mobile devices, Claude Code, and connected workflows. A user expects these interfaces to remember identity and maintain continuity. Requiring full authentication before every request would make routine work frustrating.

Claude Code uses OAuth for subscription authentication. Anthropic’s authentication documentation explains that users can also create tokens for certain development environments. These credentials let compatible tools act under an approved account relationship.

OAuth itself is not the flaw described in the reported campaign. It is a standard authorization framework used throughout modern software. The risk emerges when malware steals a valid credential, when authorization expands across clients, or when users cannot trace subsequent consumption.

The primary opponent in this story is therefore persistent convenience versus visible containment. Persistent sessions make an AI assistant useful across devices and long-running work. Visible containment lets an account owner identify, attribute, and terminate every path consuming that account.

Anthropic offers an active sessions page showing devices, browsers, approximate locations, and recent activity. Users can terminate sessions they do not recognize. This is an important control because it creates a direct path from suspicion to revocation.

However, the reported case suggests that browser sessions are only part of the picture. De Swardt said Anthropic invalidated both his sessions and server-side Claude Code tokens. A user investigating usage therefore needs a complete view across every authorization type.

Claude Code tokens, browser sessions, desktop applications, extensions, cloud tasks, and connected services can each represent legitimate access. If those categories appear in separate interfaces, users can struggle to reconstruct one account-wide timeline.

The problem becomes sharper when AI work runs asynchronously. A traditional web session usually reflects a person clicking through pages. An AI agent might continue processing a task after the user leaves the screen.

That makes background consumption normal in some circumstances. A scheduled research task, coding process, cloud agent, or connector can produce legitimate activity without an active keyboard. The same behavior makes unauthorized consumption harder to distinguish.

Providers can help by separating usage according to client, device, authorization, and task. An account owner should be able to answer basic questions without requesting a custom investigation.

Which application initiated the request? Which credential authorized it? When was that credential created? Which device or approximate network used it? How much account capacity did it consume?

Those details do not require exposing private security signals or proprietary fraud systems. They represent an audit trail for resources charged against, or deducted from, a user’s account.

This expectation already exists in cloud infrastructure. Administrators routinely review access logs, API-key activity, service identities, resource consumption, and billing records. Consumer AI subscriptions increasingly support similar professional work, but their visibility can remain closer to a media subscription.

The mismatch creates pressure for Anthropic. Claude is marketed and used as a working environment, especially when Claude Code and agents become part of daily operations. Professional dependency raises expectations for auditability and incident recovery.

It also creates pressure for other AI providers. ChatGPT, Gemini, GitHub Copilot, and independent coding tools all maintain authenticated sessions or API credentials. A malware operator has little reason to limit collection to one vendor.

The immediate campaign concerns Claude, according to Anthropic’s warning. The broader issue concerns any assistant whose credentials unlock meaningful computation or connected data.

Organizations already maintain searchable incident records, internal documentation, and access inventories. A personal knowledge system can help preserve support messages and response steps. It cannot replace endpoint security, credential revocation, or provider-side logs.

That boundary is important. Better note keeping supports investigation, but the provider must still expose the evidence needed to identify unauthorized access.

Anthropic’s Response Stops Access but Leaves Visibility Questions

Anthropic took concrete containment steps, yet users still lack a publicly documented account of the campaign’s scope and detection limits.

The company’s reported response included forced sign-outs, authorization invalidation, payment-method removal, and refunds for activity it considered unauthorized. Those actions can limit ongoing loss and protect affected users from further purchases.

Anthropic also warned recipients that the malware did not come from using Claude itself. Infostealers commonly arrive through infected downloads, deceptive advertisements, pirated software, malicious installers, or compromised packages.

This message correctly separates endpoint infection from a breach of Anthropic’s systems. Based on the available evidence, there is no verified claim that attackers penetrated Anthropic’s central model infrastructure to steal these subscriber sessions.

However, endpoint responsibility does not settle every platform question. Providers decide how long sessions remain valid, which authorizations appear in account controls, and what usage details subscribers can review.

They also decide how suspicious consumption triggers alerts. A user whose quota moves from idle to heavily used within minutes presents a potentially detectable pattern. Yet cloud tasks and agents can generate legitimate bursts, making simple thresholds unreliable.

Effective detection will likely require several signals together. These can include unfamiliar device characteristics, sudden geographic changes, unusual client software, parallel access, authorization creation, and usage inconsistent with prior behavior.

Anthropic has not publicly disclosed the thresholds used in this campaign. That is understandable because detailed fraud rules can help attackers avoid detection. Users still need high-level clarity about available protections and notification coverage.

The number of affected subscribers remains unknown. Public reporting includes several user accounts and copies of vendor emails, but those samples cannot establish prevalence. Anthropic has not published a campaign-wide victim count.

The initial infection method also remains uncertain in de Swardt’s case. Anthropic reportedly could not determine whether malware stole his session data or an outside service retained access through a prior connection.

That uncertainty limits any universal remediation advice. Removing malware is essential when a device is infected. Reviewing integrations is equally important when a third-party application received authorization.

A public security complaint also alleged that certain Claude credentials were difficult to locate or revoke through visible account controls. The report did not independently establish the source of de Swardt’s unauthorized usage.

It nevertheless highlights the right question: does terminating everything visible also terminate every credential capable of consuming account resources?

The answer must be tested for each authorization path. A global logout should have a clearly documented scope. Claude Code tokens should appear in an accessible management interface. Extensions and connected applications should disclose their permissions and last activity.

Anthropic’s documentation states that subscription OAuth is intended for native Anthropic applications and ordinary Claude Code use. Its OAuth policy restricts third-party services from repurposing subscription access in unauthorized ways.

Policy enforcement matters because stolen accounts can be pooled behind third-party gateways. However, enforcement can also suspend a victim when attackers generate prohibited traffic. That creates a second harm after the usage theft.

De Swardt said the suspension disrupted his business. From Anthropic’s perspective, disabling a compromised account can stop abuse quickly. From the subscriber’s perspective, an unexplained suspension removes a tool that might support daily operations.

A mature response needs both containment and rapid restoration. Providers should preserve evidence, isolate compromised credentials, explain the affected access path, and return legitimate users to service safely.

The skeptical conclusion is not that Anthropic ignored the problem. The company detected some cases and warned users. The unresolved issue is whether every subscriber can obtain enough information to discover and contain a similar incident independently.

Claude Users Should Treat Token Drain as a Broader Compromise

Unexpected Claude usage should trigger an endpoint-security response, not only a billing dispute.

A subscriber might first assume that a usage meter is delayed or inaccurate. That remains possible, especially when agents and background tasks share one allowance. The first step is to rule out legitimate activity systematically.

Pause scheduled tasks and cloud executions. Close Claude Code processes on known devices. Review connected services, extensions, and active sessions. Record the usage level and check whether it changes during a controlled period.

If usage continues, terminate unfamiliar sessions immediately. Anthropic’s session-management controls show device, browser, approximate location, and the last update time. Any session that does not match a known device deserves attention.

Users should also revoke Claude Code authorizations they no longer need. A browser logout and a development token are not necessarily the same credential. Every authorization category should be reviewed separately.

Do not sign back in repeatedly from a device that might remain infected. A new session can become another target if the infostealer persists. Disconnecting the device can reduce further exposure while the investigation continues.

Run reputable security tools and review recently installed software. Pay particular attention to unofficial downloads, cracked applications, browser extensions, developer packages, and copied commands from untrusted websites.

One clean scan does not prove that no infostealer existed. Some malware deletes itself after collecting data, while other variants evade a particular security product. Users handling sensitive work should consider professional incident-response support.

A stolen Claude session can signal that other credentials were exposed from the same device. Email, password managers, cloud dashboards, developer services, payment accounts, and cryptocurrency wallets might face greater consequences than lost AI usage.

Change important credentials from a device believed to be clean. End other active sessions where possible. Review account recovery settings and confirm that forwarding rules, trusted devices, and multifactor methods were not altered.

Hardware security keys can improve resistance to phishing and password theft. They do not automatically neutralize session data copied after successful authentication. Session revocation and endpoint cleanup remain necessary.

Developers should rotate secrets stored on the affected machine. Environment files, shell histories, local configuration directories, browser storage, and source repositories can contain reusable credentials.

Organizations should treat the device as potentially compromised under their existing incident process. That can include endpoint isolation, credential rotation, log preservation, identity review, and notification of internal security staff.

Users should preserve evidence before deleting everything. Screenshots of usage changes, session lists, warning messages, timestamps, local process information, and support correspondence can help establish what happened.

They should avoid publishing active tokens, session cookies, or detailed private logs while seeking help. A public troubleshooting post can accidentally expose the credentials that remain usable.

Contacting Anthropic support is still necessary. The provider can invalidate server-side authorizations, inspect patterns unavailable to the subscriber, and determine whether charges or account actions qualify for remediation.

The key is to describe the incident precisely. Provide the date, observed usage change, disabled tasks, known devices, suspicious sessions, and remediation already completed. Ask which authorization consumed the usage and whether every token family was revoked.

Users should also ask whether their account generated activity through an unfamiliar client. A client identifier can distinguish a hidden local process from a remote gateway, browser replay, or authorized integration.

For teams, the same event should prompt a review of shared AI access. Individual subscription credentials should not circulate among employees or automation systems. Shared credentials weaken attribution and make revocation more disruptive.

Business workflows need contingency plans as well. When an assistant becomes central to coding or administration, an account suspension can halt operations. Critical procedures, credentials, and records should remain accessible without one AI service.

Three Signals Will Show Whether the Claude Token Theft Is Contained

The next phase will depend on better account telemetry, clearer revocation behavior, and evidence that suspicious usage is declining.

The first signal is a stronger account-wide usage ledger. Subscribers need attribution by client, authorization, task, and time period. A release that adds those details would directly address the diagnostic gap exposed by de Swardt’s case.

Such a ledger would strengthen Anthropic’s position because users could distinguish legitimate agents from stolen access quickly. If visibility remains limited to aggregate percentages, the central accountability problem will remain.

The second signal is explicit documentation for global revocation. Anthropic should clarify whether a full sign-out terminates browser sessions, mobile sessions, desktop sessions, extensions, Claude Code credentials, and server-side authorizations.

Clearer controls would make containment predictable. Continued reports of usage after users revoke everything visible would weaken confidence and suggest that some authorization paths remain difficult to manage.

The third signal is the campaign’s reported frequency. Anthropic does not need to publish sensitive detection rules, but it can disclose whether notifications and forced sign-outs are increasing or declining.

Fewer credible reports would support the view that detection and revocation are limiting the campaign. Continued clusters of unexplained usage would show that attackers still find subscriber sessions economically useful.

Competitor responses will provide supporting context. If other AI providers expand session dashboards or consumption alerts, the industry will be treating authenticated AI access as a distinct security category.

For Claude users, the practical question is immediate: can every unit of unexpected usage be traced to a device, task, or authorization? Until the answer is yes, unexplained token drain deserves the same urgency as an unfamiliar cloud login.

Hackers are stealing Claude tokens from subscribers because persistent sessions have real value. Anthropic has begun warning and protecting detected victims. The lasting test is whether users gain enough visibility to recognize the next stolen session before it consumes their work capacity.