Hackers are stealing Claude tokens from subscribers

On August 4, Grant de Swardt, an autarkic AI advisor successful East Sussex, UK, noticed thing unusual going connected with his Claude Max 20x account. He hadn’t been moving that day, yet his token usage was climbing.

The adjacent day, helium disabled everything helium had attached to Claude and did not enactment with it. Token depletion again increased. “In the clearest controlled interval, it accrued from 45% to 55% portion I performed nary work, scheduled Cowork tasks were paused oregon completed, Dispatch/cloud execution was disabled, and determination was nary corresponding progressive section Claude Code task,” de Swardt told TechCrunch.

What was eating up his token allowance? He had nary idea, truthful helium contacted Anthropic and asked for an itemized list. Anthropic didn’t supply one, but it agreed thing was off. It suspended his paid account, invalidated each of his sessions and server-side Claude Code tokens, and issued him a partial refund of £44.49 for the remaining clip connected his $200-per-month subscription.

The suspension wreaked havok connected his business, helium told TechCrunch. His occupation is to assistance tiny and mid-size businesses acceptable up agents — a benignant of forward-deployed technologist for prosecute — for tasks similar automatically loading purchase-order information from emails into the accounting software.

As a sole proprietor, helium relies connected agents passim his full business, too: regular admin tasks, website design, coding. “Like everything is conscionable moving done AI these days,” helium said.

After investigating, Anthropic told de Swardt it recovered the culprit: A compromised Claude league cardinal was utilized to mint unauthorized Claude Code OAuth tokens. The institution told him the relationship “appeared to person been utilized by an unauthorized-looking third-party work to grip enactment for different people, but they could not find however it obtained access,” helium told TechCrunch. “They accidental the grounds is accordant either with credentials/session information being taken without my knowledge, oregon with the relationship having been connected to an extracurricular service.”

In different words, a hacker was capable to get entree to de Swardt’s relationship and was covertly siphoning disconnected his tokens. Because relationship enactment tracks full usage but not itemized usage, adjacent upon request, this benignant of theft could person gone connected for months undetected.

He posted his experience connected Reddit and aft 80 comments, helium discovered helium was not alone. One idiosyncratic claimed that their relationship “was auto-upgraded without my consent, my recognition paper got charged, and the usage changeable from 0% to 100% automatically without maine adjacent touching it.” Another saw usage spell from 0 and to 49 percent successful 12 mins, erstwhile each they had utilized it for was a mates of prompts and web search.

One Claude idiosyncratic said their relationship burned done its max tokens each time for 3 days without them utilizing it astatine all, and created a Github report astir it. Like with the Reddit post, others users shared akin experiences there, too.

Two of them posted emails from Anthropic wherever the institution had — to its recognition — identified and warned them that their tokens were being stolen.

“We person precocious go alert of a atrocious histrion that is utilizing communal infostealer malware to bargain Claude login sessions from people’s computers, past utilizing those login sessions to entree Claude accounts and devour their usage,” the email read. Infostealers are a benignant of malware that installs itself connected a user’s machine and steals saved passwords, league data, and login-credentials.

When Anthropic saw suspicious activity, it signed the users out, invalidated existing authorizations, issued immoderate refunds and warned them that they whitethorn person malware.

The institution besides said the malware didn’t travel from utilizing Claude itself. Such malware tin beryllium picked up from galore sources online, from downloading infected bundle to clicking connected infected ads.

Anthropic did not nonstop de Swardt 1 of those emails. He insists helium recovered nary grounds that his machine was compromised, and says helium inactive has nary mode of determining however hackers gained access.

de Swardt’s Claude relationship was reinstated aft astir 2 weeks. But the trouble of getting speedy assistance for the matter, positive the deficiency of an itemized usage, soured him connected Claude. He cancelled his subscription successful favour of Cursor and its quality to usage aggregate models, including much affordable open-source options.

In his experience, these different models enactment arsenic good arsenic Claude. “It’s not that overmuch antithetic oregon better,” helium said, adding that helium can’t spot going backmost “without them really having resolved the contented successful immoderate way.” He says Anthropic inactive lacks tools that allows users to spot what’s consuming their tokens. “I don’t deliberation there’s immoderate mode that these radical tin support themselves.”

When asked for accusation connected however users tin place misuse, Anthropic declined to comment.