Claude token theft: your AI subscription is now worth stealing
Hackers are draining Claude subscribers' token quotas using infostealer malware. It isn't a platform breach, it's your laptop, and the billing model makes it hard to notice.
Claude token theft is the kind of story that reads like a platform breach and isn't one. TechCrunch reported on hackers stealing Claude tokens from subscribers: people are watching their monthly quota drain while they sleep.
The attacker never touched Anthropic's servers. They touched a laptop. That distinction is the whole story, and it's the part worth thinking about if you pay for any AI subscription from here.
🔍 The account wasn't hacked. The computer was.
On 4 August 2026, an independent AI consultant named Grant De Swardt noticed his Claude Max 20x account burning quota while he wasn't working. Usage climbed from 45% to 55% during a stretch where he did nothing at all.
Anthropic's finding, as reported: "a compromised Claude session key was used to mint unauthorized Claude Code OAuth tokens." The company later told users that a bad actor was using common infostealer malware to lift Claude login sessions off people's computers and then log in with them.
That's the mechanism, and it's an old one wearing new clothes:
| What the attacker needed | What they did not need |
|---|---|
| A session key sitting on the victim's disk | The account password |
| Malware already running as the user | A 2FA code |
| Somewhere to send the stolen file | Any bug in Anthropic's infrastructure |
An active session is what your password and your second factor produce. Once it exists, it stands downstream of both. A stolen session key skips the entire login you were so careful about.
📊 Why a quota is now a resellable asset
Look at the reported burn patterns and you can tell nobody was sitting at a keyboard:
| Reported symptom | What it implies |
|---|---|
| 0% to 100% of quota in half an hour | Automated, heavily parallel usage |
| 0% to 49% in 12 minutes | Same, and tuned to move fast before detection |
| Quota burned three days running | Persistent access, not a smash-and-grab |
| Account suspended for ~2 weeks | The real cost is downtime, not the tokens |
De Swardt was on a $200/month plan and received a partial refund of £44.49. Do the arithmetic on that and the picture gets clearer: he lost far more in working days than in money.
A stolen Claude session isn't like a stolen credit card, where the bank eats the loss. It's closer to someone squatting in your office. You keep paying rent, and you can't get in.
Prepaid compute with no per-call authorisation prompt is exactly the sort of thing that grows a resale market. Nothing needs to be laundered. The quota is spent directly on inference, which is the thing the buyer actually wanted.
🕳️ The part I find hardest to accept
According to the report, Anthropic suspended affected accounts, invalidated sessions and server-side tokens, issued refunds and warned users about the malware. That's a reasonable incident response.
What it did not do is give users itemised usage breakdowns or guidance on how to spot misuse themselves.
Key takeaway: You are paying for a metered resource you cannot audit. If the only signal that someone is spending your quota is a percentage bar moving while you're asleep, detection is a matter of luck.
Compare that to every other metered service a small team buys:
| Service | Can you see line-item usage? |
|---|---|
| AWS / GCP | Yes, per-service, per-hour |
| Any bank card | Yes, per transaction, with merchant |
| Dialog / SLT data | Yes, per session |
| AI chat subscription | A percentage bar |
I don't think this is malice. I think usage logs weren't designed as a security surface, because nobody expected quota to become a theft target. That assumption has now expired.
🛠️ What I'd do this week
Five things, in the order I'd do them:
- Assume the token is on disk. Any CLI that keeps you logged in stores something in your home directory. Know where, and treat that directory like a keyring:
ls -la ~/.claude/ 2>/dev/null # keys pasted into dotfiles, scripts, notebooks: grep -rl "sk-ant" ~/.bashrc ~/.zshrc ~/.env ~/projects 2>/dev/null - Log out everywhere, then log back in once. This invalidates old sessions. Rotating your password alone does nothing if the attacker already holds a live session.
- Check your usage graph deliberately, not accidentally. Once a week, at a fixed time, look at the shape of the curve. You are the monitoring system here.
- Stop pasting API keys into files you commit. Environment variables and a
.gitignoreentry, every time. No exceptions for "just testing". - Treat the machine as the perimeter. Infostealers arrive through cracked installers, fake "download" buttons, and browser extensions that ask for more than they need. Patch the delivery route, not the symptom.
🇱🇰 Why this lands harder from here
Three reasons this story is sharper for a Sri Lankan developer or small team than for a US one:
- Cracked software is still a normal delivery path. Keygens and patched installers are the classic infostealer carrier worldwide, and pretending that culture doesn't exist here helps nobody. One patched IDE on one machine puts every credential on it in play.
- Account sharing is how teams afford the top tiers. Splitting a $200/month plan five ways is rational when you're billing in rupees and paying in dollars. It also means five endpoints, and the weakest one decides the outcome for everybody. A suspension doesn't hit one person, it hits the whole group.
- A two-week suspension against a foreign client deadline is the actual damage. You cannot email a client in a timezone eight hours behind and explain that your tooling is frozen pending an investigation.
If you're weighing the top tier against a cheaper plan plus API access, work out what a burned month genuinely costs you before you decide. Our AI subscription cost calculator will do the comparison in a couple of minutes, and it's worth doing with the downtime risk in the same column as the price.
💡 What this means for you
The shift here is small and permanent: your AI subscription has become a credential worth stealing, in the same category as a bank login or a cloud key. It didn't used to be. Enough compute is now sitting behind a single session token that someone will pay for it.
So treat it like one:
The session is the secret, not the password. The laptop is the perimeter, not the provider. Until usage logs get detailed enough to audit, you are the only person actually watching your own bill.
None of that needs new software or a bigger budget. It needs you to decide that the account you use for eight hours a day deserves the same care as the one holding your money.
Original source
Hackers are stealing Claude tokens from subscribersAI-assisted draft, reviewed and approved by Induwara Ashinsana before publishing. Sources are linked inline; if something here is wrong, tell me and it gets corrected.