Claude Subscribers Target of Token Theft
Anthropic subscribers are facing security issues as hackers reportedly siphon off paid Claude tokens using compromised session keys. According to TechCrunch, independent AI consultant Grant De Swardt noticed his usage climbing while his account was inactive. After contacting support, Anthropic informed him that a compromised session key was used to mint unauthorized Claude Code OAuth tokens.
Subscribers discussing the issue on Reddit and GitHub reported similar incidents, including accounts being automatically upgraded, credit cards charged without consent, and token usage surging rapidly during periods of zero activity. Affected users shared communications from Anthropic identifying a bad actor utilizing common infostealer malware to harvest login sessions from local machines.
Infostealers can infiltrate computers through infected software or malicious online advertisements, though Anthropic confirmed the malware did not originate from using Claude itself. When suspicious activity is detected, the company has taken steps to sign users out, invalidate existing authorizations, issue partial refunds, and warn affected customers about potential system compromises.
Despite these security measures, users have criticized the platform for a lack of granular, itemized usage tracking that would allow customers to easily identify what is consuming their token allowance. Following a temporary account suspension and what he described as a difficult support process, De Swardt cancelled his subscription in favor of alternative development tools supporting multiple models.
Anthropic declined to comment when asked for specific guidance on how users can identify and prevent token misuse on the platform. The incidents highlight growing security challenges for enterprise and professional users relying heavily on continuous generative AI workflows.
Based on reporting by techcrunch.com.
