Claude Token Theft Exposes the Weak Spots in AI Subscription Security

Introduction

For people who depend on AI tools for coding, administration, and business operations, a compromised account can cause more than a privacy problem. It can consume a paid allowance, trigger unexpected charges, and interrupt work. That is what several Claude subscribers say happened after their accounts continued using tokens while they were not actively working.

Anthropic has warned some users that a bad actor may have used infostealer malware to capture login sessions from their computers. Those sessions could then be reused to enter Claude accounts and consume their available usage. The company also said the malware did not come from using Claude itself.

What happened to one subscriber?

Grant De Swardt, an independent AI consultant in East Sussex, noticed that his Claude Max 20x account was consuming tokens on a day when he had done no work. He then paused the tools attached to Claude and stopped using the service altogether. During what he described as a controlled interval, usage still rose from 45% to 55%, despite scheduled tasks being paused or completed, cloud execution being disabled, and no active local Claude Code task.

Anthropic suspended the account, invalidated its sessions and server-side Claude Code tokens, and issued a partial refund of £44.49 for the remaining subscription period. The company later told him that a compromised Claude session key had been used to create unauthorized Claude Code OAuth tokens. It also believed the account had been used by an unauthorized third-party service to handle activity for other people. However, Anthropic could not determine how the attacker obtained access.

The security and support gaps

• Usage was not sufficiently itemized. Support could track total consumption, but could not provide a detailed breakdown of what consumed the allowance. That makes covert abuse difficult to detect and investigate.
• A valid session may be enough. Anthropic told some users that infostealer malware can capture saved passwords, session data, and login credentials. Such malware can be distributed through infected software, malicious advertising, or other online sources.
• The financial impact can be immediate. Users described accounts reaching their limits without meaningful activity. One user also claimed the account was upgraded without consent and charged to a credit card.
• Account recovery can disrupt businesses. De Swardt said the suspension affected his work as a consultant who builds agents for small and midsize businesses. His account was restored after roughly two weeks, but he ultimately canceled the subscription and moved to Cursor.

Why this matters

The reports do not establish that Claude itself distributed the malware, nor do they prove that every unusual usage report came from the same campaign. They do show, however, that AI account security now includes more than password protection. Browser sessions, OAuth authorizations, and tokens used for remote execution can all become valuable targets.

For users, the practical response is to sign out unknown sessions, revoke unfamiliar authorizations, inspect devices for malware, and avoid untrusted downloads. For AI providers, detecting suspicious activity and invalidating sessions is only a first step. Subscribers also need detailed usage records, understandable authorization controls, timely alerts, and a faster dispute process. As AI becomes embedded in business workflows, usage visibility is part of reliability—not merely a billing feature.

Source: TechCrunch AI