Claude Session Theft: Subscribers See Their Tokens Disappear

Several Claude customers report that their quotas have evaporated without apparent use. Anthropic mentions session thefts by malware and explains that it has revoked access and refunded certain accounts. A British consultant, deprived of access for nearly two weeks, has canceled his subscription and points to the lack of detailed usage statements.

Two Weeks of Downtime and a Canceled Subscription

Grant de Swardt's account was restored after an interruption of about two weeks. He expressed frustration with the slow support and the fact that no detailed usage statement was provided. He canceled his subscription to switch to Cursor, which allows the use of multiple models, including more affordable open-source options. According to him, these models offer comparable performance to Claude, and he does not plan to return until the issue is resolved. He also claims that tools to identify what consumes the tokens are still lacking. He believes there is no effective way to protect oneself. When asked how users can spot abuses, the company declined to comment.

Anthropic Describes Session Theft via an Infostealer

Users have shared emails where the company warned that it was seeing token thefts. In these emails, it explains that a malicious actor is using a common infostealer malware to steal Claude login sessions on computers, then access accounts to consume quotas. When suspicious activity is detected, the company disconnects accounts, invalidates permissions, issues refunds, and warns of a possible infection. It specifies that this malware does not originate from the use of the service. Such software can be obtained online, particularly through infected downloads or advertisements. However, Grant de Swardt did not receive these alert messages. The company informed him that a compromised session key had been used to create unauthorized OAuth tokens and mentioned the possible use of his account by a third-party service, without being able to establish the origin of the access. It also proposed two scenarios compatible with the clues: theft of credentials or session data, or connection of the account to an external service.

Reports of Unauthorized Usage by Other Customers

After sharing his case on Reddit, Grant de Swardt received numerous responses and found that he was not alone. One user reported a usage spike from 0% to 100% after an upgrade charged without consent. Another described a jump from 0 to 49% in 12 minutes for a few queries and a web search. A third mentioned a daily quota exhausted over three days without use, before opening a report on GitHub where others shared similar cases.

Incident Origin: Unexplained Spike and Account Reactions

On August 4, a usage spike appeared on Grant de Swardt's Claude Max 20x account while he was not working. The next day, despite disabling all elements linked to Claude, consumption continued to rise. In a controlled interval, usage increased from 45% to 55% while Cowork tasks were paused or completed, Dispatch/cloud execution was turned off, and no local Claude Code tasks were running. He requested a detailed statement from the company, which acknowledged a problem without providing specifics. The company suspended his account, invalidated sessions and tokens on the server side, and issued a partial refund of £44.49 for a subscription billed at $200 per month. According to him, this suspension severely disrupted his business, which relies on agents for integrating order data into accounting software, as well as for administration, web design, and coding. The service tracks overall usage but not the details, even upon request, so that a theft could, according to the estimate given, go unnoticed for months.