Claude users report unauthorized token theft by hackers

On August 4, 2026, Grant De Swardt, an AI consultant in East Sussex, noticed his Claude Max 20x account was consuming tokens without his activity. After disabling all integrations, token usage continued to rise, prompting him to contact Anthropic. The company suspended his account, refunded part of his subscription, and identified a compromised session key used to mint unauthorized OAuth tokens. Anthropic confirmed a third-party service was likely accessing his account, though the exact method remains unclear. De Swardt’s account was reinstated after two weeks, but he canceled his subscription due to lack of transparency and itemized usage tracking. Other users reported similar issues, with some seeing token usage jump from 0% to 100% without use. Anthropic acknowledged a malware threat, noting infostealers could steal login credentials, but did not notify De Swardt. The company urged users to check for malware but declined to comment on specific user inquiries. De Swardt emphasized the need for better tools to monitor token consumption, highlighting ongoing security concerns for Claude users.