Grant De Swardt stared at his usage graph. The independent AI consultant in East Sussex, U.K., hadn’t touched Claude that day. Yet tokens burned. Fast.
He shut down every integration. Paused agents. Disabled cloud tasks. The next day, consumption climbed again. From 45% to 55% in a quiet window. No work. No scheduled jobs. Nothing.
“In the clearest controlled interval, it increased from 45% to 55% while I performed no work,” De Swardt told TechCrunch. He contacted Anthropic. The company suspended his $200-a-month Max 20x account, killed all sessions and server-side tokens, then refunded part of his subscription.
De Swardt runs his entire one-person business on AI now. Admin. Design. Code. Everything. The theft hit hard. And he wasn’t alone.
Anthropic has quietly notified dozens of paying users since late August 2026. The pattern repeats. Usage spikes while owners sleep or step away. Limits refill, then empty. No login alerts. No new devices flagged. Just silent drain on premium accounts.
The culprit? Common infostealer malware. Nothing fancy. Vidar, LummaC2, StealC, RedLine, Acreed on Windows machines. Atomic Stealer on some Macs. These programs have harvested browser data for years. Passwords. Cookies. Saved logins. Now they grab something more valuable: active Claude sessions.
Once stolen, attackers replay the session cookie. They skip passwords entirely. They bypass multifactor authentication. The session proves the user already logged in. So the thief steps right into the account with full access. And starts spending.
Anthropic’s Response and the Scale of the Problem
Anthropic spotted the abuse through usage anomalies. In emails sent to victims, the company explained the threat directly.
“We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers, then using those login sessions to access Claude accounts and consume their usage,” one such email read, as shared by affected Reddit users and reported across outlets including The Register and Malwarebytes.
The company signs victims out everywhere. Removes saved payment methods. Refunds unauthorized charges. But the malware stays on the victim’s machine until they clean it. Log back in on an infected computer? The cycle can repeat.
One Reddit user, WorriedAssociate7029, traced their infection to a pirated game. They had cleaned the system with help from another AI model, only to receive Anthropic’s warning days later. The email noted their Claude session was likely among the data lifted.
But. The problem runs deeper. Paid Claude subscriptions now carry real street value. High-tier plans cost hundreds monthly. Heavy users burn through millions of tokens. Attackers don’t just consume for themselves. Some appear to route activity through compromised accounts for third parties. Like a shadow proxy service running on someone else’s dime.
De Swardt learned Anthropic suspected his account fed an unauthorized third-party service. The company couldn’t pinpoint exactly how access was first gained. Credentials. Session data. Or perhaps an outside integration gone wrong. The evidence fit multiple scenarios.
Similar stories surfaced on forums. Users posted Anthropic emails. Each described the same pattern. Refilled quotas drained while the owner was away. The company has invalidated sessions across multiple victims. Yet the infostealers continue spreading. They arrive through cracked software, fake apps, malicious downloads. Once on the system, they vacuum everything.
And the exposure stretches beyond burned tokens. Stolen Claude sessions can carry permissions to connected tools. OAuth tokens minted for Claude Code. Access to linked SaaS platforms. Gmail. Corporate accounts. The session replay grants entry without triggering enterprise single sign-on revocation in many self-serve setups.
Security researchers have tracked related techniques for months. Earlier this year, teams found ways to hijack Claude Code’s Model Context Protocol to redirect and steal OAuth tokens. Those attacks required local machine access too. The pattern holds. Compromise the endpoint. Own the identity.
Recent reports from today echo the same warnings. Discussions on X highlight frustration among developers. One post noted a $200 monthly subscription effectively becoming free API access for thieves. Others urged tighter monitoring of usage graphs and immediate key rotation where possible.
Anthropic stresses the malware has no connection to Claude itself. It doesn’t arrive through the platform. Users pick it up elsewhere. Still, the incident reveals how AI services have joined the ranks of valuable targets alongside streaming accounts and cryptocurrency wallets. Tokens equal compute. Compute equals money.
Enterprise users face different risks. Many rely on SSO and centralized identity. But individual subscribers and small teams on credit-card billing sit exposed. No admin console to force logout. No easy way to audit every session in real time.
The company now acts faster on suspicious patterns. It invalidates tokens aggressively. Issues partial refunds. Yet prevention rests largely with users. Clean machines. Avoid pirated tools. Monitor usage daily. Treat browser sessions as sensitive as passwords.
De Swardt got his account back. Partial refund in hand. But the experience left him wary. His business depends on these tools. So do thousands of others. As AI consumption grows, so does the incentive to steal it.
Short-term fixes help. Session invalidation. Payment removal. But the root issue persists. Infostealers evolve. Attackers sift stolen logs for high-value sessions. Claude. OpenAI. Others will follow. The economics make sense. Why pay for tokens when you can take them?
Users should watch their dashboards closely now. Spikes without activity scream compromise. Contact support immediately. And clean the endpoint before logging back in. Because the next login on dirty hardware hands the keys right back.
The thefts mark a shift. AI isn’t just innovative technology anymore. It’s infrastructure. Expensive infrastructure. And thieves have noticed.