If your Claude usage meter has ever jumped for no reason, you're not alone — and it might not be a bug.
Last month, a wave of Claude subscribers reported the same unsettling pattern: their token allowance burning down fast on days they weren't even using the product. Anthropic has now confirmed the cause. It isn't a billing glitch. It's theft.
The account that burned through 55% of its limit doing nothing
The story broke into public view through Grant De Swardt, an independent AI consultant based in East Sussex, UK, who runs a one-person consultancy building AI agents for small businesses. On August 4, he noticed his Claude Max 20x account — a $200-a-month plan — was chewing through tokens on a day he hadn't touched it. TechCrunch first reported his case on September 8.
So he ran a controlled test. He disabled every integration connected to his account, paused his scheduled tasks, and did no work at all. Usage kept climbing anyway, moving from 45% to 55% of his limit with nothing running on his end.
When he pushed Anthropic for an itemized breakdown of what was consuming his quota, the company couldn't produce one — but it agreed something was wrong. It suspended his account, invalidated all his sessions and Claude Code tokens, and refunded a portion of his subscription.
The eventual explanation: a compromised session key had been used to mint unauthorized Claude Code OAuth tokens, and his account appeared to have been used by an outside service to process work for other people entirely. Anthropic told him it couldn't determine how access was obtained in the first place.
He wasn't the only one
When De Swardt shared his experience on Reddit, the replies made clear this wasn't an isolated glitch. One user described their account auto-upgrading and getting charged without consent, usage jumping from 0% to 100% on its own. Another watched usage climb from zero to 49% in twelve minutes after nothing more than a couple of prompts and a single web search.
A separate GitHub issue collected more of the same: one user reported their account burning through its full daily limit for three days straight with no activity from them at all.
Two of those users had actually received a warning email from Anthropic. The company told them it had identified a bad actor using off-the-shelf infostealer malware — the kind that quietly harvests saved passwords and session data from an infected computer — to hijack Claude login sessions and rack up usage on the victims' dime.
One follow-up report named specific malware families behind the campaign — Vidar, LummaC2, and StealC, all well-known in the infostealer world — though that detail hasn't been independently confirmed by Anthropic or in the original reporting, so it's worth treating as provisional rather than settled.
Why this attack doesn't need your password
This is the part that makes the incident worth understanding, not just wincing at. The attackers aren't guessing passwords or breaking two-factor authentication. They're stealing session cookies — the small tokens your browser or Claude Code client holds onto so you don't have to log in every five minutes.
If malware on your machine copies that session data, an attacker can walk into your account as if they were you, no password or 2FA prompt required, and start spending your token allowance on whatever they want.
In De Swardt's case specifically, Anthropic told him his account looked like it had been plugged into a third-party service handling work for other people — a possible resale setup — though the company said it couldn't determine exactly how access was gained. It's not clear the other reported cases followed the same pattern.
That's also why it's so hard to detect. A stolen session doesn't trigger a new-device login alert the way a stolen password might. And because Anthropic's account tools track total usage rather than a per-request log, there's currently no way for a subscriber to see exactly what consumed their quota, even after asking. TechCrunch's reporting makes the implication explicit: that gap means this kind of theft could plausibly continue for months without anyone noticing.
Anthropic's side of it: it says the malware doesn't come from using Claude itself, and that once it spots the suspicious pattern, it signs the account out, invalidates the compromised sessions, and in some cases issues a refund and a warning. That's a real response, but it's after the fact — it doesn't give users a way to catch this themselves in real time. Asked directly how users can identify misuse on their own, Anthropic declined to comment.
What you can actually do about it
Since the entry point is malware on your device rather than a flaw in Claude itself, the defense is mostly standard endpoint hygiene, applied a bit more seriously:
Run a malware scan on any machine that's logged into Claude, especially if you've downloaded cracked software, questionable browser extensions, or clicked ads from unfamiliar sites — the usual delivery methods for infostealers.
Rotate your credentials and sessions — log out of Claude everywhere, change your password, and if you use Claude Code, regenerate your API keys and OAuth tokens.
Watch your usage graph, not just your bill. A spike that doesn't match a day you remember working is worth investigating immediately rather than assuming it's a fluke.
Remove saved payment methods from the account if you suspect compromise, until you've confirmed the device is clean.
Be cautious with long-lived, unattended sessions — CI pipelines, cron jobs, and always-on agent setups are exactly the kind of authenticated, hard-to-monitor access an infostealer thrives on.
Anthropic isn't uniquely exposed here. Any subscription AI product that authenticates via session cookies rather than requiring a fresh login has the same underlying weakness. But for now, Claude users are the ones dealing with the fallout — and, in at least one case, ended up canceling a $200/month subscription over it, not because a competing model was better, but because it didn't have to be: it just wasn't the one getting drained.
Further reading:
Comments (0)
Login to post a comment.