Executive Overview
In an increasingly AI-dependent enterprise ecosystem, token quotas have effectively become a new digital currency. Recent security incidents surrounding Anthropic’s high-tier Claude platform demonstrate how cybercriminals are pivoting from traditional credential theft to harvesting session keys and AI access tokens. By exploiting vulnerabilities in client-side credential storage through common infostealer malware, malicious actors have begun systematically siphoning expensive artificial intelligence computation allowances from legitimate subscribers.
The exposure of this threat model came to light following a series of unexplained usage spikes reported by power users on Anthropic’s top-tier subscriptions—most notably the $200-per-month Claude Max 20x tier. Affected users observed their daily token allocations draining rapidly while their accounts remained completely idle, with zero local prompts or active background tasks running. Subsequent disclosures from Anthropic confirmed that external threat actors were utilizing stolen browser session keys to mint unauthorized Claude Code OAuth tokens, converting compromised accounts into unauthorized computation proxies for third-party traffic.
This systemic abuse highlights a growing vulnerability in the AI ecosystem: the lack of granular telemetry and itemized audit logging for end users. While major cloud computing providers offer detailed cost-and-usage tracking, major Large Language Model (LLM) vendors currently lack real-time, itemized usage breakdowns. Consequently, victimized users face catastrophic operational disruptions when their accounts are abruptly suspended or exhausted without clear diagnostic tools or immediate technical recourse.
Detailed Chronology: The Grant de Swardt Case & Community Outcry
The Initial Anomaly in East Sussex
The real-world consequences of token siphoning surfaced on August 4, when Grant de Swardt, an independent AI consultant operating in East Sussex, UK, noticed abnormal activity on his Claude Max 20x account. De Swardt, who pays $200 per month for the premium service to build and deploy specialized AI agents for small and mid-sized enterprises (SMEs), had stepped away from his workstation for the day. Despite zero active input, his account dashboard reflected a steady, unexplained escalation in token consumption.
Determined to isolate the root cause, de Swardt executed a controlled diagnostic protocol the following day, August 5:
- System Isolation: De Swardt disabled all local integrations, external software hooks, and developer tools linked to his Claude account.
- Execution Pause: Scheduled Cowork tasks were paused or marked complete, cloud-side execution via Dispatch was shut down, and local terminal instances running Claude Code were completely terminated.
- Controlled Observation Interval: Despite zero interaction and complete system idle state, token usage ticked upward from 45% to 55% during a strictly monitored timeframe.
"In the clearest controlled interval, it increased from 45% to 55% while I performed no work… and there was no corresponding active local Claude Code task," de Swardt reported.
[System State: Fully Idle / Disconnected]
Time T+00: Usage Bar @ 45% ──┐
├── (No active user prompts, no local code running)
Time T+60: Usage Bar @ 55% ──┘ Account Freeze and Severe Operational Impact
Recognizing a potential breach or system glitch, de Swardt submitted a formal inquiry to Anthropic support, requesting an itemized log of API calls, IP addresses, and token consumption by session. Anthropic’s support infrastructure was unable to provide a granular usage ledger. However, support personnel acknowledged that anomalous backend behavior was occurring.
To mitigate further risk, Anthropic initiated an abrupt account intervention:
- Account Suspension: De Swardt’s paid subscription was immediately frozen.
- Session Invalidation: All existing web sessions, API tokens, and server-side Claude Code OAuth tokens were purged.
- Financial Settlement: A pro-rated refund of £44.49 was issued for the remaining balance of his $200-per-month subscription.
For a sole proprietor whose business relies on AI agents—ranging from building automated purchase-order parsers for clients to managing daily administrative tasks, website maintenance, and code generation—the sudden, two-week account lock proved devastating.
"Like everything is just running through AI these days," de Swardt explained, noting that the inability to access his primary development model brought his business operations to an abrupt halt.
Investigation Findings and Third-Party Proxy Networks
Following an internal security review, Anthropic communicated its diagnostic findings to de Swardt. The investigation revealed that an unauthorized party had acquired a compromised Claude session key. The attacker used this session credential to mint fresh, valid Claude Code OAuth tokens.
According to Anthropic’s communications, the compromised account was subsequently linked to an unauthorized third-party infrastructure. This entity was acting as a proxy, routing computational requests from external users through de Swardt’s paid tier allowance. Anthropic stated the evidence was consistent with two primary threat vectors:
- Credential or session cookie theft executed via local client-side malware without the user’s knowledge.
- An unauthorized connection between the account credentials and an external, unvetted web service or API proxy.
Widespread Impact Across the AI Developer Community
De Swardt detailed his findings on Reddit (r/ClaudeAI), triggering a flood of responses that revealed his case was far from an isolated incident. Dozens of developers and researchers corroborated the pattern, detailing identical symptoms across various forums and public repositories.
+----------------------------------------------------------------------------------+
| COMMUNITY INCIDENT REPORTS |
+-------------------+--------------------------------------------------------------+
| Platform | Reported Symptom |
+-------------------+--------------------------------------------------------------+
| Reddit User A | Account auto-upgraded without consent; usage surged 0%->100% |
| Reddit User B | Usage jumped 0% to 49% within 12 mins via minimal prompts |
| GitHub Issue #82506| Token allowance fully depleted daily for 3 consecutive days |
+-------------------+--------------------------------------------------------------+A official issue report filed on the public GitHub repository for anthropics/claude-code (Issue #82506) became a central hub for impacted engineers. Multiple users shared communication snippets from Anthropic security confirming that session hijacking was taking place across the platform.
Supporting Context & Technical Metrics: How Session Siphoning Works
The Mechanics of Infostealers and Token Exploitation
The threat vector identified by Anthropic relies on common Infostealer Malware families—such as Lumma, RedLine, or Vidar. These malicious programs infect endpoint devices through malicious software downloads, compromised browser extensions, or deceptive search engine advertisements.
Unlike traditional ransomware that encrypts hard drives, infostealers run silently in the background, harvesting sensitive data stored in web browser profiles:
- Cookie Harvesting: The malware scans local browser directories for active session tokens, specifically targeting
session_keyvalues set by domain identifiers likeclaude.ai. - Exfiltration: The stolen cookies are compressed and exfiltrated to a Command and Control (C2) server operated by threat actors.
- Session Replay & OAuth Minting: Attackers import the session cookies into automated frameworks, bypassing traditional Multi-Factor Authentication (MFA) because the cookie represents an already-authenticated session.
- Token Minting: Using the hijacked web session, the attacker interacts with Anthropic’s account endpoints to mint persistent OAuth tokens intended for developer utilities like Claude Code.
- Proxy Monopolization: The generated developer tokens are funneled into proxy networks or resold on underground market forums, allowing non-paying third parties to send heavy computational prompts at the legitimate owner’s expense.
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Victim Computer │ │ Threat Actor C2 │ │ Anthropic Cloud │
└────────┬────────┘ └────────┬────────┘ └────────┬────────┘
│ │ │
│ 1. Infostealer steals │ │
│ Browser Session │ │
│────────────────────────>│ │
│ │ 2. Replay Session & │
│ │ Mint OAuth Token │
│ │────────────────────────>│
│ │ │
│ │ 3. Route Third-Party │
│ │ Prompts via Token │
│ │<───────────────────────>│
│ │ (Drains Victim Quota) │The Telemetry Deficit in Modern LLM Platforms
A major point of friction for affected users is the lack of detailed usage metrics provided by LLM platforms compared to traditional cloud infrastructure.
When an engineer manages assets on Amazon Web Services (AWS) or Google Cloud Platform (GCP), security and operational teams have access to granular logging frameworks (such as AWS CloudTrail or GCP Cloud Logging). These services provide real-time data on every API request:
- Source IP Address & Geolocation
- User-Agent String
- Exact Timestamp (UTC)
- Resource Cost & Payload Volume
In contrast, consumer and prosumer AI interfaces—including Claude, ChatGPT, and similar offerings—typically provide aggregate progress meters (e.g., "50% of 5-hour limit used"). Without an itemized transaction log detailing IP origin or query timestamps, end users cannot audit their own usage. This lack of transparency allows token theft to persist undetected until daily limits are abruptly exhausted.
Official Statements & Response Frameworks
Anthropic’s Direct Communication to Users
In formal communications dispatched to a subset of affected accounts, Anthropic acknowledged the threat vector and outlined its remediation measures.
In an official notification sent to compromised users, Anthropic wrote:
"We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers, then using those login sessions to access Claude accounts and consume their usage."
The company clarified that the security breach did not originate within its core infrastructure or model hosting environment. Instead, credentials were harvested from client-side endpoints through external malware vector chains, such as drive-by downloads or malicious search ads.
When suspicious traffic patterns were flagged by internal security systems, Anthropic took the following steps:
- Signed affected account holders out of all active web and API sessions.
- Invalidated all existing authorization headers and persistent tokens.
- Issued pro-rated refunds for affected billing cycles.
- Distributed advisory alerts urging users to scan local hardware for malware.
ANTHROPIC REMEDIATION INCIDENT RESPONSE
┌────────────────────────────────────────────────────────┐
│ 1. Anomaly Flagged via Automated Usage Analytics │
├────────────────────────────────────────────────────────┤
│ 2. Global Session Invalidation & Token Revocation │
├────────────────────────────────────────────────────────┤
│ 3. Automated Account Suspension & Pro-Rated Refund │
├────────────────────────────────────────────────────────┤
│ 4. Client Notification & End-Point Security Warning │
└────────────────────────────────────────────────────────┘Support Bottlenecks and Missing Notifications
Despite these measures, gaps in communication remain. Grant de Swardt noted that he never received an explicit malware notification email from Anthropic. Furthermore, local endpoint scans on his devices yielded no evidence of active infostealer payloads.
Because Anthropic refused official comment when asked for specific guidance on how users can independently diagnose or prevent token theft, developer frustration has mounted. The long delays in account restoration—paired with the complete suspension of paid accounts during security reviews—have forced many affected engineers to seek alternative providers.
Future Outlook: Security Vulnerabilities in the Agentic AI Era
The Move Toward Multi-Model IDEs and Alternatives
The friction experienced by power users during security incidents is driving shifts in developer workflows. After his account was reinstated following a two-week lockout, de Swardt permanently canceled his $200-per-month Claude subscription. He has since shifted his primary workflows to alternative coding environments like Cursor, which offer multi-model flexibility.
This multi-model strategy allows developers to route tasks across different underlying engines, including open-source options like DeepSeek and Meta’s Llama models, reducing dependency on any single vendor.
┌─────────────────────────────────────────────────────────┐
│ DEVELOPER WORKFLOW SHIFT │
├─────────────────────────────────────────────────────────┤
│ SINGLE-VENDOR DEPENDENCY ──► MULTI-MODEL RESILIENCE │
│ • Monolithic API key • Heterogeneous models │
│ • Single point of failure • Open-source fallbacks │
│ • Aggregated usage caps • Local weight hosting │
└─────────────────────────────────────────────────────────┘"It’s not that much different or better," de Swardt noted, comparing Claude’s performance to competitor offerings. He stated he has no plans to return to Anthropic’s platform "without [them] actually having resolved the issue in any way."
Technical Imperatives for LLM Providers
To secure developer ecosystems against session hijacking, industry analysts emphasize that AI platforms must adopt enterprise-grade authentication standards:
- IP Pinning for Active Web Sessions: Session cookies should be hard-bound to the originating client IP block or TLS fingerprint. Any sudden geographic shift in traffic should automatically trigger an MFA challenge before API access is granted.
- Granular Developer Telemetry: Platforms must offer user-accessible audit logs showing timestamped request histories, token usage breakdowns per key, and incoming IP addresses.
- Hardware Token Binding: High-tier accounts should support strict WebAuthn/FIDO2 hardware keys for creating, viewing, or renewing developer API keys and OAuth credentials.
- Anomalous Velocity Rate-Limiting: Automated security rules should instantly quarantine account access if prompt execution patterns shift dramatically within brief timeframes (e.g., zero usage to 100% capacity within minutes).
Conclusion
As businesses increasingly integrate autonomous AI agents into their daily operations, the infrastructure supporting these tools must adapt to modern threat models. Session key hijacking and token siphoning highlight the growing risk of relying on single platforms that lack granular security telemetry. Until AI vendors implement real-time usage auditing, robust IP-bound session controls, and faster incident response times, individual developers and businesses remain vulnerable to credential theft that can disrupt operations overnight.
