For AI power users and independent contractors, subscription-based AI services like Anthropic’s Claude have transitioned from novel productivity tools to the central nervous system of their businesses. But for Grant De Swardt, an AI consultant based in East Sussex, U.K., that dependency turned into a digital nightmare this past August.
On August 4, De Swardt noticed an anomaly that would eventually expose a significant security vulnerability affecting an unknown number of users. Despite not having performed any work that day, his Claude "Max 20x" account was hemorrhaging tokens. What began as a confusing usage spike quickly spiraled into a total account suspension, a disrupted business, and a sobering realization about the fragility of modern AI security.
The Chronology of a Digital Heist
The trouble started on a Sunday. De Swardt, accustomed to monitoring his resource allocation as a sole proprietor who relies on AI agents for everything from website design to automated accounting, noticed his usage climbing while his terminal was idle.
By August 5, he initiated a "controlled experiment" to isolate the variables. He disabled every integration, paused all scheduled tasks, and disconnected his local Claude Code execution environment. Despite this total lockdown of his own activity, his token consumption surged from 45% to 55% in real-time.
"In the clearest controlled interval, it increased from 45% to 55% while I performed no work," De Swardt told TechCrunch.
After reaching out to Anthropic, the company acknowledged that his account behavior was irregular. However, the support process was opaque. Anthropic did not provide an itemized usage log—a feature that remains conspicuously absent from their platform—but they acted swiftly to mitigate the damage. They suspended his paid account, invalidated all active sessions, revoked his server-side Claude Code tokens, and issued a partial refund of £44.49 for the remaining duration of his $200-per-month subscription.
The fallout for De Swardt was immediate. As a consultant who helps small businesses deploy AI agents to manage workflows like email-to-accounting data migration, his entire professional infrastructure was built on the assumption of a secure, reliable Claude connection. The suspension wasn’t just a loss of a tool; it was a professional "havoc" event.
The "Infostealer" Epidemic
Following an internal investigation, Anthropic’s findings suggested a sophisticated, albeit common, vector of attack: a compromised session key. The company informed De Swardt that his credentials appeared to have been utilized by an unauthorized third-party service, potentially to facilitate AI tasks for other, paying customers.
The mechanism, as identified by security experts and corroborated by subsequent company communications, is "infostealer" malware. This type of malicious software embeds itself on a user’s local machine, silently scraping saved browser passwords, cookies, and session tokens.
Because modern web applications—including major AI platforms—rely on session cookies to maintain a logged-in state, a thief does not need a user’s password if they have the session token. By importing this token into their own browser, a hacker can essentially "become" the victim, bypassing multi-factor authentication (MFA) entirely, as the platform perceives the attacker’s device as a trusted, already-authenticated session.
Anthropic eventually confirmed this pattern to other affected users. In emails sent to victims, the company stated: "We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers, then using those login sessions to access Claude accounts and consume their usage."
A Pattern of Silent Theft
De Swardt’s experience, while harrowing, was far from unique. His Reddit thread, which garnered over 80 comments, became a digital confessional for users experiencing identical unexplained drain.
One user reported their account being auto-upgraded without consent, with their credit card charged and usage hitting 100% while the machine was powered down. Another user witnessed their usage skyrocket from 0% to 49% in a mere 12-minute window, despite performing only two simple web queries. Similar reports have surfaced on GitHub, where users have opened tickets specifically to document the rapid depletion of their daily token limits.
The severity of the situation is compounded by the lack of transparency. Because Anthropic’s administrative backend tracks total usage but does not provide granular, itemized history to the end user, this theft can persist for weeks or months. Victims have no way to verify if a spike in usage was their own complex prompt or a malicious agent siphoning their resources to power a third-party service.
Implications for the AI Ecosystem
The incident highlights a critical "security gap" in the AI industry. As LLMs become integrated into the deep plumbing of enterprise software, the cost of a compromised session is no longer just a privacy breach—it is a financial and operational liability.
1. The Transparency Deficit
The most glaring issue is the lack of auditing tools. In the world of cloud computing (e.g., AWS or Google Cloud), users can drill down into their billing logs to see exactly which service or API call triggered a cost. For AI platforms like Claude, the "black box" nature of usage tracking leaves the customer helpless. When a user cannot see how their tokens are being spent, they cannot detect theft until their account is effectively neutralized.
2. The Limits of MFA
While Anthropic and other AI firms mandate strong passwords and MFA for logins, these measures are rendered toothless by session-hijacking malware. If an attacker steals a live session cookie, they skip the front door and go straight to the living room. This forces a conversation about whether AI platforms should implement "IP binding" or stricter device-fingerprinting to invalidate sessions if the connection origin shifts dramatically.
3. The Burden on the User
Anthropic maintains that the malware is not a result of using their service, but rather a byproduct of broader internet hygiene. While legally accurate, this puts an immense burden on the user. For a professional like De Swardt, being told to "clean your computer" is cold comfort when their business operations are being throttled by a security flaw that the platform is not yet equipped to identify in real-time.
The Aftermath and Future Outlook
After two weeks of limbo, De Swardt’s account was reinstated. However, the experience left a permanent mark on his professional relationship with the platform. He has since migrated his workflows to Cursor, citing its flexibility in switching between multiple models—including more affordable, open-source alternatives—as a key advantage.
His decision to move on stems from a lack of confidence in Anthropic’s resolution process. "I don’t think there’s any way that these people can protect themselves," he noted, pointing to the persistent lack of itemized usage tracking.
When approached for comment regarding future security measures or the implementation of usage-transparency dashboards, Anthropic declined to comment.
The incident serves as a stark reminder of the "wild west" era of generative AI. While companies are racing to scale the capabilities of their models, the administrative and security infrastructure surrounding these tools is still in its infancy. For now, users remain the first and last line of defense, left to monitor their own token usage with a wary eye, hoping that a sudden jump in activity is the result of a complex prompt rather than an invisible thief in the machine.
As AI becomes the foundation of the modern digital economy, the industry must pivot toward greater transparency and more robust session management. Until then, the "token drain" may become a standard, if frustrating, feature of the AI experience.
