Stolen session keys drained Claude token quotas

TechCrunch reports that Claude Max subscribers are losing paid usage to attackers, and Anthropic’s support couldn’t show one of them where the tokens went. Independent AI consultant Grant De Swardt watched his allowance climb on August 4, a day he did no work.

“In the clearest controlled interval, it increased from 45% to 55% while I performed no work,” he told TechCrunch. Anthropic later said a compromised session key had been used to mint unauthorized Claude Code OAuth tokens. It suspended his account, invalidated his sessions, and refunded £44.49 of his $200-per-month subscription.

Other users described the same pattern on Reddit and GitHub. Anthropic emailed some of them about “a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers.” De Swardt cancelled and moved to Cursor.