Anthropic users reportedly hit by stolen Claude sessions

TechCrunch reported that at least some Anthropic customers had Claude usage consumed without their knowledge after account access was stolen. Its article centres on Grant De Swardt, an independent consultant in East Sussex, who told TechCrunch that his Claude Max account kept burning tokens while he was not using it. After he contacted Anthropic, the company suspended the account, invalidated sessions and server-side Claude Code tokens, and issued a partial refund, according to TechCrunch.

TechCrunch says Anthropic later told De Swardt that a compromised Claude session key had been used to mint unauthorised Claude Code OAuth tokens. The company reportedly said the evidence was consistent either with credentials or session data being taken without his knowledge, or with the account having been connected to an outside service.

What users could and could not see

The article says De Swardt asked for an itemised usage list but did not receive one. TechCrunch also cites Reddit posts, a GitHub report and emails users said they received from Anthropic. In those emails, Anthropic said it had become aware of a bad actor using common infostealer malware to steal Claude login sessions from people’s computers and then consume account usage.

According to TechCrunch, Anthropic signed affected users out, invalidated existing authorisations, issued some refunds and warned that their machines might have malware. The report also says Anthropic declined to comment when asked how users can identify misuse. That leaves an awkward gap between total usage and usable forensic detail for customers trying to work out what happened.