By Tech Investigative Desk
Published: August & September 2025
Main Facts
The rapid integration of generative artificial intelligence into daily business operations has introduced unprecedented productivity gains, but it has simultaneously unlocked novel attack vectors for malicious actors. In early August, a growing wave of security anomalies hit high-tier power users of Anthropic’s Claude ecosystem. At the center of this emerging cybersecurity concern is a sophisticated token-siphoning campaign driven by common infostealer malware, which stealthily harvests local session keys to hijack premium AI accounts.
Grant De Swardt, an independent AI consultant based in East Sussex, U.K., discovered firsthand that his heavily utilized $200-per-month Claude Max 20x subscription was being drained while his systems were completely idle. Despite taking proactive steps—such as pausing scheduled tasks, disabling cloud execution environments, and disconnecting local coding interfaces—De Swardt watched in real-time as his token consumption surged from 45% to 55% during a strict, controlled period of zero activity.
Further investigation by both affected users and Anthropic’s security team revealed a widespread campaign. Bad actors are leveraging infostealers—malicious software designed to pillage saved browser credentials, session cookies, and authorization tokens directly from local user machines—to mint unauthorized Claude Code OAuth tokens. Once compromised, these hijacked accounts are covertly repurposed to handle third-party processing demands, leaving legitimate owners to foot the bill and suffer severe business disruptions.
Compounding the problem is a notable lack of granular transparency within major AI platform dashboards. Because account support systems typically track only aggregate, top-level usage metrics rather than itemized, session-specific breakdowns, token theft can proceed undetected for weeks or even months. For sole proprietors and small-to-medium-sized enterprises (SMEs) that rely on AI agents as foundational infrastructure, these silent breaches represent more than a minor financial nuisance; they constitute a critical operational hazard.
Chronology of an AI Security Incident
The unfolding saga of the Claude token heists illustrates how quickly a routine digital workflow can devolve into a major operational crisis.
August 4: The First Red Flags
Grant De Swardt was not even working on August 4, yet he noticed irregularities within his Claude Max 20x account. His token usage meters were climbing steadily upward despite the absence of any manual prompts, active coding sessions, or background automation tasks.
August 5: The Controlled Isolation Test
Determined to isolate the variable, De Swardt instituted a strict diagnostic protocol the following day. He completely disabled all external integrations attached to his Claude environment and refrained from performing any development work. Yet, token consumption continued its upward trajectory. In a definitive test interval, his usage climbed from 45% to 55% while all scheduled Cowork tasks were paused or completed, Dispatch and cloud execution features were entirely turned off, and local Claude Code processes were dormant.
Escalation and Account Suspension
Unable to diagnose the source of the drain, De Swardt reached out to Anthropic support requesting an itemized ledger of his token usage. While Anthropic’s support team could not provide a granular breakdown, they acknowledged anomalous activity. In response, they abruptly suspended his paid account, invalidated all active sessions and server-side Claude Code tokens, and issued a partial refund of £44.49 for the remaining duration of his billing cycle.
The Business Impact and Two-Week Blackout
The sudden suspension wreaked havoc on De Swardt’s consulting operations. Operating as a sole proprietor and forward-deployed engineer for hire, De Swardt assists SMEs in automating complex workflows—such as transferring purchase-order data directly from email clients into accounting software. Furthermore, his entire internal administrative apparatus, from website design to code generation, relied on Claude agents. For two weeks, his primary business engine was stalled.
Discovery and Community Consensus
Following his suspension, De Swardt shared his bizarre ordeal on a Reddit community thread (r/ClaudeAI). Within hours, the comment section exploded with nearly a hundred testimonies from other users experiencing identical symptoms. Accounts were auto-upgraded without consent, credit cards were charged unexpectedly, and zero-activity token metrics spiked from 0% to 100% within minutes. Parallel reports surfaced on GitHub repositories, confirming that De Swardt’s case was not an isolated glitch, but part of a systemic compromise.
Supporting Data and Community Evidence
The anecdotal accounts shared across developer forums and support tickets highlight a widespread, coordinated effort by bad actors to exploit authenticated AI sessions.
When users began cross-referencing their logs on GitHub and Reddit, several distinct patterns emerged regarding the nature of the token drainage:
- Instantaneous Spikes: One user reported that their token usage surged from 0% to 49% within a compressed 12-minute window, despite their session being utilized for nothing more than a couple of basic text prompts and a singular web search.
- Persistent Daily Drains: Another developer documented a distressing trend where their account burned through its maximum daily token allowance for three consecutive days while completely unutilized, prompting them to file a formal GitHub issue tracker report.
- Involuntary Upgrades: Multiple individuals claimed their accounts experienced unauthorized tier changes, triggering unexpected credit card charges and immediate token exhaustion without their direct intervention.
These community findings prompted Anthropic to issue targeted warning emails to several affected users. The corporate advisories shed light on the mechanics of the attack:
"We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers, then using those login sessions to access Claude accounts and consume their usage."
Infostealers operate invisibly, residing deep within the file systems of infected machines. They bypass traditional perimeter defenses by targeting authenticated session data stored locally in web browsers and application caches. Once these session cookies and OAuth tokens are exfiltrated, attackers can remotely interact with cloud services while impersonating the legitimate user, effectively rendering Multi-Factor Authentication (MFA) useless for the duration of the active hijacked session.
Official Responses and Corporate Stance
Despite issuing warnings to select users whose accounts were flagged by internal telemetry, Anthropic’s overarching response has drawn criticism from security-conscious customers regarding transparency and communication consistency.
While the company acted decisively to protect compromised accounts by signing users out, invalidating existing server-side authorizations, and offering partial financial restitution, its remediation process was far from uniform. Notably, Grant De Swardt did not receive one of Anthropic’s warning emails, nor was he provided with a clear explanation of how his specific credentials were compromised.
When questioned about the origin of the security breaches, Anthropic maintained that the infostealer malware did not originate from vulnerabilities within the Claude application itself. Instead, the company noted that such malware is ubiquitous across the broader digital landscape, frequently picked up through infected software downloads, deceptive advertisements, or compromised third-party browser extensions.
Furthermore, when pressed by investigative journalists for actionable guidance on how users can proactively identify, audit, and trace account misuse within their developer dashboards, Anthropic representatives declined to comment. This hesitation to provide detailed tooling or itemized telemetry has left many enterprise users feeling exposed, as they lack the visibility required to verify whether their allocated compute resources belong solely to them.
Implications for the AI Industry and Enterprise Users
The Claude token-siphoning incidents serve as a critical wake-up call for the broader artificial intelligence sector. As generative tools transition from experimental novelties to mission-critical business infrastructure, they become prime targets for cybercriminals seeking high-value computational power.
1. The Granular Visibility Gap
The most glaring takeaway from De Swardt’s ordeal is the inadequacy of current usage-tracking architectures. Major AI vendors have built their platforms to measure aggregate consumption for billing purposes, but they have largely neglected to provide users with itemized, session-traceable activity logs. Without the ability to track what specific prompt, API call, or automated agent consumed a given batch of tokens, users are flying blind. Cybersecurity experts argue that transparent, real-time auditing tools must become a mandatory baseline feature for any enterprise-grade AI subscription.
2. The Vulnerability of Local Session Persistence
Infostealers represent an insidious threat to modern cloud-native workflows. Because developers and power users frequently store local session tokens to maintain seamless continuity between Integrated Development Environments (IDEs) and cloud APIs, they inadvertently create high-value honeypots on their local machines. A single compromised endpoint can compromise an entire corporate cloud infrastructure. Moving forward, AI platforms may need to implement stricter re-authentication protocols, hardware-bound cryptographic tokens, or zero-trust local execution models to mitigate this risk.
3. Customer Retention and Trust Deficit
For individual practitioners like Grant De Swardt, the financial loss and operational downtime were compounded by a frustrating support experience. The difficulty in receiving rapid assistance, coupled with a lack of definitive answers regarding how the breach occurred, permanently damaged his trust in the platform. Consequently, De Swardt permanently cancelled his Anthropic subscription and migrated his workflows to Cursor—an alternative development environment that supports multiple AI models, including more cost-effective open-source options.
Reflecting on his decision, De Swardt noted that alternative models perform on par with Claude, stating, "It’s not that much different or better," and adding that he sees no reason to return "without [Anthropic] actually having resolved the issue in any way."
Conclusion
As AI agents become deeply embedded in the day-to-day operations of modern enterprises, security cannot stop at the cloud perimeter. Vendors and users alike must adapt to a landscape where endpoints are constantly targeted by stealth malware. Unless AI providers like Anthropic invest heavily in transparent usage analytics, robust session monitoring, and proactive threat communication, incidents like the Claude token heists risk eroding user trust and driving professionals toward more secure, decentralized alternatives.
