Evan Lee Salim
On August 4, Grant De Swardt, an independent AI consultant operating out of East Sussex, U.K., encountered a perplexing and ultimately costly anomaly within his Claude Max 20x account, marking the beginning of a saga that would shed light on significant security vulnerabilities and transparency issues within the rapidly evolving AI service industry. Despite not having actively engaged with his account on that particular day, De Swardt observed a troubling escalation in his token usage, an invisible but tangible drain on his paid resources. This initial observation quickly spiraled into a full-blown investigation, uncovering a pattern of unauthorized activity that extended beyond his individual experience, raising critical questions about the security of AI subscriptions and the accountability of platform providers.
The Unseen Drain: A Chronology of Discovery
De Swardt’s initial concern on August 4 was a subtle flicker of unease. As an AI consultant specializing in integrating advanced artificial intelligence agents for small and mid-sized businesses, he meticulously tracks his resource consumption. The unexpected uptick in token usage on a day he had taken off work immediately signaled a deviation from the norm. Tokens, the fundamental units of computational work in large language models (LLMs) like Anthropic’s Claude, represent a direct cost to users, making their unbidden consumption akin to a utility meter running without active appliance use.
The situation intensified the following day. Determined to isolate the cause, De Swardt took decisive action, systematically disabling all services and integrations linked to his Claude account. He refrained from any personal interaction with the platform, ensuring a controlled environment for observation. Despite these precautions, the token consumption continued its inexplicable ascent. He documented this critical period, noting to TechCrunch that "In the clearest controlled interval, it increased from 45% to 55% while I performed no work, scheduled Cowork tasks were paused or completed, Dispatch/cloud execution was disabled, and there was no corresponding active local Claude Code task." This direct, quantifiable evidence of passive consumption underscored the severity of the issue: something external and unauthorized was actively siphoning his resources.
Perplexed and unable to identify the source of the drain, De Swardt reached out to Anthropic, the developers behind Claude. His primary request was for an itemized breakdown of his token usage, a standard feature in many digital service subscriptions that would allow him to pinpoint the specific activities consuming his allowance. However, Anthropic was unable or unwilling to provide such granular data. Despite this lack of detailed transparency, the company acknowledged that something was indeed amiss. In response, they suspended his paid account, invalidated all active sessions and server-side Claude Code tokens, and issued a partial refund of £44.49, compensating him for the remaining period on his $200-per-month subscription.
Business Interruption and the Sole Proprietor’s Dilemma
While the refund offered a partial financial reprieve, the suspension of his Claude account inflicted significant disruption on De Swardt’s business operations. As a sole proprietor, his consultancy thrives on the seamless integration and deployment of AI agents. His work involves setting up automated solutions for clients, such as systems that automatically process purchase order data from emails into accounting software. These agents, essentially "forward-deployed engineers for hire," are central to modern business efficiency, offering automation capabilities that save time and reduce manual errors.
Beyond client-facing projects, De Swardt’s own operational framework is deeply embedded with AI. From daily administrative tasks and website design to coding and internal project management, AI agents form the backbone of his entrepreneurial ecosystem. "Like everything is just running through AI these days," he remarked, emphasizing the pervasive reliance on these tools in contemporary digital businesses. The sudden, enforced hiatus from his primary AI platform not only halted ongoing client projects but also crippled his internal workflow, highlighting the critical interdependence between AI consultants and the very platforms they leverage. For small and medium-sized businesses (SMBs) and independent professionals, downtime of this nature translates directly into lost productivity, missed deadlines, and potential financial strain, underscoring the broader economic implications of platform instability or compromise.
Unveiling the Culprit: Compromised Session Keys and Infostealer Malware
After a period of investigation, Anthropic communicated its findings to De Swardt. The company concluded that a compromised Claude session key had been exploited to mint unauthorized Claude Code OAuth tokens. This technical explanation pointed to a sophisticated breach, indicating that an external entity had gained illicit access to his account credentials. Anthropic further suggested that the account "appeared to have been used by an unauthorized-looking third-party service to handle activity for other people," although they could not definitively ascertain the precise method of access. The company’s assessment offered two possibilities: "credentials/session data being taken without my knowledge, or with the account having been connected to an outside service."
In essence, De Swardt’s account had been compromised by a malicious actor who was covertly utilizing his paid token allowance. The lack of an itemized usage log, even upon direct request, meant that this type of surreptitious token theft could persist for extended periods, potentially accumulating significant costs before detection. This incident brought to the forefront a critical gap in user visibility and control over their AI service consumption.
A Community Responds: De Swardt Is Not Alone
Seeking answers and solidarity, De Swardt shared his ordeal on Reddit, posting his experience to the r/ClaudeAI community. The response was swift and telling, with over 80 comments quickly accumulating, revealing that his predicament was far from isolated. Other users recounted strikingly similar experiences, painting a picture of a broader, systemic issue.
One user detailed how their account "was auto-upgraded without my consent, my credit card got charged, and the usage shot from 0% to 100% automatically without me even touching it." Another reported usage soaring from 0% to 49% in a mere 12 minutes, despite having only performed a couple of prompts and a web search. These accounts resonated deeply with De Swardt’s own experience of rapid, unexplained token consumption.
The problem’s scope widened further when another Claude user reported their account burning through its maximum token allowance daily for three consecutive days without any personal interaction. This user took the initiative to create a detailed GitHub report, which subsequently became a repository for more shared experiences. Two users on GitHub even posted emails they had received directly from Anthropic, which, to the company’s credit, proactively identified and warned them about token theft.
These emails from Anthropic provided crucial insight into the nature of the attacks. They stated: "We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers, then using those login sessions to access Claude accounts and consume their usage." The company explained that infostealers are a insidious class of malware designed to infiltrate a user’s computer and illicitly extract sensitive data, including saved passwords, session cookies, and login credentials. When Anthropic detected suspicious activity consistent with these attacks, they took protective measures: signing users out, invalidating existing authorizations, issuing refunds, and advising users that their devices might be infected with malware. Importantly, Anthropic clarified that the malware was not originating from Claude itself but was being acquired from various online sources, such as infected software downloads or malicious advertisements.
The Cybersecurity Landscape: The Threat of Infostealers
The revelations from Anthropic’s emails underscored a pervasive and growing threat in the digital landscape: infostealer malware. These sophisticated malicious programs represent a significant vector for credential theft, posing a risk to any online service that relies on session data or saved login information. Cybercriminals deploy infostealers through various insidious means, including phishing campaigns, malicious software bundles, compromised websites, and infected email attachments. Once a device is compromised, the malware stealthily harvests sensitive data in the background, often without the user’s immediate knowledge.
The global prevalence of infostealer attacks has seen a significant increase in recent years, with cybersecurity reports indicating a substantial year-over-year rise in detections. This surge reflects the high value placed on stolen credentials and session data in underground markets, where they can be resold for various illicit activities, including financial fraud, identity theft, and, as seen in De Swardt’s case, the unauthorized consumption of digital services. For AI platforms, where access often grants costly computational power, compromised sessions present a particularly attractive target for malicious actors looking to monetize stolen access. The lack of an itemized usage log exacerbates this problem, as it creates a blind spot for users trying to detect anomalous activity that could signal a compromise.
Unanswered Questions and a Shift in Trust
Despite Anthropic’s broader explanation to other affected users, De Swardt’s specific case remained shrouded in lingering uncertainty. He never received one of the proactive warning emails from Anthropic, and crucially, he insisted that his own extensive investigations yielded no evidence of his computer being compromised by infostealer malware. This left him without a definitive answer as to how the hackers gained access to his account, deepening his sense of vulnerability and frustration.
After approximately two weeks, De Swardt’s Claude account was reinstated. However, the ordeal – the initial detection difficulties, the lack of itemized usage data, the business disruption, and the unresolved questions surrounding his specific breach – severely eroded his trust in the platform. The experience prompted a reevaluation of his AI toolchain. He ultimately canceled his Claude subscription, opting instead for Cursor, an alternative platform that offers the flexibility to integrate multiple AI models, including more cost-effective open-source options.
De Swardt noted that the performance of these alternative models was comparable to Claude’s. "It’s not that much different or better," he stated, signaling a potential parity in capabilities among leading LLMs for many practical applications. He expressed a strong reluctance to return to Claude "without [Anthropic] actually having resolved the issue in any way." His primary concern remained the fundamental lack of transparency and control. He contended that Anthropic still lacked the essential tools for users to effectively monitor and understand their token consumption, concluding, "I don’t think there’s any way that these people can protect themselves."
Broader Implications and the Call for Transparency
The experiences of Grant De Swardt and numerous other Claude users highlight several critical implications for the burgeoning AI services industry:
-
The Imperative of Transparency in Usage Tracking: In a subscription-based model where usage directly correlates with cost, detailed, itemized billing and real-time usage dashboards are not merely conveniences but essential tools for user security and financial accountability. The absence of such features leaves users vulnerable to undetected theft and makes it nearly impossible to diagnose the source of anomalous consumption. This incident serves as a stark reminder that as AI platforms become integral to business operations, their transparency must match the criticality of the services they provide.
-
Enhanced Security Protocols for AI Platforms: While Anthropic correctly pointed out that infostealers originate outside their platform, the incident underscores the need for AI service providers to implement robust security measures that can detect and mitigate the impact of compromised sessions. This includes proactive monitoring for unusual usage patterns, rapid invalidation of suspicious session tokens, and clear communication channels with affected users. The AI industry, poised for immense growth (projected to reach hundreds of billions in market value in the coming years), must prioritize security infrastructure to safeguard user data and computational resources.
-
User Education and Cybersecurity Best Practices: The prevalence of infostealer malware necessitates a heightened awareness among AI users regarding general cybersecurity hygiene. Practices such as using strong, unique passwords, enabling multi-factor authentication (MFA), exercising caution with software downloads and email attachments, and regularly scanning for malware are more crucial than ever. While platforms bear responsibility for their security, users also play a vital role in protecting their digital footprint.
-
Impact on Trust and Vendor Loyalty: For independent consultants and SMBs heavily reliant on AI, incidents of account compromise and service disruption can severely impact trust and lead to churn. The ability to seamlessly switch to alternative providers, as De Swardt demonstrated, indicates a competitive market where security, transparency, and reliable customer support are becoming increasingly important differentiators alongside AI model performance.
When approached for comment regarding how users can identify and protect themselves from misuse, Anthropic declined to provide further information. This silence, in the face of widespread user concern, further emphasizes the ongoing challenge for AI platforms to balance proprietary information with the critical need for user transparency and proactive security guidance. The experiences detailed by De Swardt and the community of affected users serve as a wake-up call, urging AI service providers to prioritize user security, enhance transparency, and provide more robust tools to ensure the integrity and accountability of their increasingly indispensable services.
