Infostealer malware is silently draining Claude Max subscribers' token limits

On August 4, Grant De Swardt, an independent AI consultant in East Sussex, U.K., noticed that his Claude Max 20x account was consuming tokens despite him not working that day. The next day, after disabling all attached tools and pausing scheduled tasks, his token usage climbed from 45% to 55% while he performed no work. De Swardt contacted Anthropic, which agreed something was off, suspended his paid account, invalidated all sessions and server-side Claude Code tokens, and issued a partial refund of £44.49 for the remaining time on his $200-per-month subscription. The suspension disrupted his business, which relies on AI agents for daily admin, website design, and coding tasks for small and mid-size clients.

The mechanics of the theft

After investigating, Anthropic told De Swardt that a compromised Claude session key was used to mint unauthorized Claude Code OAuth tokens. The company stated the account "appeared to have been used by an unauthorized-looking third-party service to handle activity for other people, but they could not determine how it obtained access." De Swardt noted that the evidence was consistent with credentials or session data being taken without his knowledge, or the account being connected to an outside service. In other words, a hacker obtained access to his account and covertly siphoned off his tokens. Because account support tracks total usage but not itemized usage, even upon request, this kind of theft could have gone on for months undetected.

De Swardt posted his experience on Reddit, where he discovered he was not alone. One user claimed their account was auto-upgraded without consent, their credit card was charged, and usage shot from 0% to 100% automatically. Another saw usage go from 0 to 49% in 12 minutes after only a couple of prompts and a web search. One Claude user said their account burned through its max tokens every day for three days without them using it at all, leading them to create a GitHub report about the issue. Other users shared similar experiences there, including two who posted emails from Anthropic where the company had identified and warned them that their tokens were being stolen.

Anthropic’s response and the malware vector

Anthropic’s email to affected users stated: "We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers, then using those login sessions to access Claude accounts and consume their usage." Infostealers are a type of malware that installs itself on a user’s computer and steals saved passwords, session data, and login credentials. When Anthropic saw suspicious activity, it signed users out, invalidated existing authorizations, issued some refunds, and warned them that they may have malware. The company also said the malware didn’t come from using Claude itself, noting that such malware can be picked up from many sources online, from downloading infected software to clicking on infected ads.

However, Anthropic did not send De Swardt one of those warning emails. He insists he found no evidence that his computer was compromised and says he still has no way of determining how hackers gained access. De Swardt’s Claude account was reinstated after about two weeks. But the difficulty of getting speedy help for the matter, plus the lack of an itemized usage report, soured him on Claude. He cancelled his subscription in favor of Cursor and its ability to use multiple models, including more affordable open source options. In his experience, these other models work as well as Claude. "It’s not that much different or better," he said, adding that he can’t see going back "without [Anthropic] actually having resolved the issue in any way."

What it means for developers

For developers and consultants who rely heavily on AI coding tools, this incident highlights a critical gap in security and transparency. The lack of itemized usage tracking means users cannot easily detect unauthorized consumption. As De Swardt put it, "I don’t think there’s any way that these people can protect themselves." Anthropic declined to comment on how users can identify misuse. This is particularly concerning for sole proprietors and small businesses that depend on AI agents for core business functions. The incident underscores the need for better security practices, such as using hardware security keys, regularly auditing session logs, and monitoring token usage for anomalies. Developers should also be cautious about downloading software from untrusted sources and clicking on ads, as these are common vectors for infostealer malware.

What to watch

• Whether Anthropic will implement itemized usage tracking or provide tools for users to monitor token consumption in real-time.
• How many other users have been affected by this infostealer malware campaign, and whether Anthropic will provide a more detailed report on the scope of the breach.
• Whether other AI coding tools, such as Cursor or GitHub Copilot, have similar vulnerabilities or if they have implemented additional security measures to prevent session hijacking.
• The potential for regulatory action or increased scrutiny on AI companies regarding data security and user privacy, especially as AI tools become more integral to business operations.