On August 4, Grant De Swardt, an independent AI consultant operating out of East Sussex, U.K., observed a disturbing anomaly within his Anthropic Claude Max 20x account. Despite abstaining from work activities that day, his allocated token usage was inexplicably climbing, signaling an unauthorized drain on his computational resources. This initial observation would soon unravel a broader issue, exposing vulnerabilities in AI service security and highlighting a critical need for enhanced user transparency in the burgeoning artificial intelligence sector.
The incident began innocently enough, with De Swardt performing his routine checks. As an AI consultant specializing in integrating sophisticated AI agents for small and mid-size businesses, his reliance on platforms like Claude is foundational to his professional existence. His role often involves deploying these intelligent systems to automate complex tasks, from processing purchase orders embedded in emails to streamlining accounting software entries. Consequently, accurate monitoring of token consumption is paramount to managing client costs and his own operational overhead. The unexpected spike in usage on a non-working day was therefore not merely an inconvenience but a direct threat to his business model.
A Chronology of Suspicion and Investigation
De Swardt’s initial concern deepened the following day, August 5. Taking proactive measures, he systematically disabled every application and service linked to his Claude account, ensuring no legitimate activity could account for further token consumption. Yet, the unauthorized usage persisted. As he recounted to TechCrunch, “In the clearest controlled interval, it increased from 45% to 55% while I performed no work, scheduled Cowork tasks were paused or completed, Dispatch/cloud execution was disabled, and there was no corresponding active local Claude Code task.” This concrete evidence of continued, unbidden consumption solidified his suspicion that an external entity was illicitly accessing his account.
Perplexed by the mysterious drain, De Swardt immediately contacted Anthropic, the developer of Claude, requesting a detailed, itemized breakdown of his token usage. Such a ledger would typically pinpoint the specific functions or API calls consuming resources, allowing users to identify and rectify any issues. However, Anthropic was unable to provide the requested itemized list, a critical deficiency that would later become a focal point of De Swardt’s dissatisfaction.
Despite the inability to furnish a granular report, Anthropic acknowledged that something was amiss. The company took decisive action, suspending De Swardt’s paid account, invalidating all associated sessions and server-side Claude Code tokens, and issuing a partial refund of £44.49. This reimbursement represented the unused portion of his $200-per-month subscription, an implicit admission that De Swardt had been unfairly charged for services he had not authorized. While the swift action to secure the account was appreciated, the lack of transparency regarding the usage data and the initial disruption caused significant concern.
The Mechanics of AI Usage: Understanding Tokens and Costs
To fully grasp the gravity of De Swardt’s situation, it is crucial to understand the underlying economic model of large language models (LLMs) like Claude. Unlike traditional software with fixed licensing fees, most advanced AI services operate on a consumption-based model, where users are charged based on "tokens." A token can represent a word, a sub-word, or even punctuation, and every input prompt, every generated response, and even internal processing by the AI consumes a certain number of these tokens. The cost per token varies between models and providers, but for businesses relying heavily on AI, managing token usage is akin to managing utility bills. Unchecked consumption can lead to exorbitant and unexpected expenses, directly impacting profitability.
For an AI consultant like De Swardt, whose entire professional ecosystem revolves around AI agents, token management is not merely an administrative task; it is a core business function. He utilizes these agents for a wide array of tasks, from daily administrative duties and website design to complex coding projects. As he articulated, “Like everything is just running through AI these days,” underscoring the deep integration of AI into modern business operations. The sudden loss of access to his Claude account, even for a temporary period, thus translated into a significant disruption, hindering his ability to serve clients and manage his own enterprise effectively.
Unmasking the Culprit: Compromised Session Keys and Infostealer Malware
After a thorough internal investigation, Anthropic eventually provided De Swardt with an explanation for the unauthorized activity. The company concluded that a compromised Claude session key had been exploited to mint unauthorized Claude Code OAuth tokens. This technical diagnosis pointed to a sophisticated form of cyber intrusion. De Swardt relayed Anthropic’s findings: the account “appeared to have been used by an unauthorized-looking third-party service to handle activity for other people, but they could not determine how it obtained access.” Anthropic suggested two primary vectors for the breach: either his credentials/session data were stolen without his knowledge, or his account had been inadvertently connected to a malicious outside service.
The absence of an itemized usage log exacerbated the problem. Had such a feature been available, De Swardt might have detected the anomalous activity much earlier, potentially mitigating the extent of the theft. Without it, illicit token siphoning could theoretically persist for months, unnoticed, until the accumulated charges became overtly noticeable or the account allowance was entirely depleted. This lack of granular visibility represents a significant blind spot for users attempting to safeguard their AI resources.
A Community Echoes: Other Users Report Similar Breaches
De Swardt’s personal ordeal resonated deeply within the broader AI user community. He documented his experience on Reddit, sharing his story under a thread that quickly garnered over 80 comments. The responses revealed a troubling pattern: De Swardt was not an isolated victim. Numerous other Claude users reported similar inexplicable token consumption. One user recounted a startling incident where their account was “auto-upgraded without my consent, my credit card got charged, and the usage shot from 0% to 100% automatically without me even touching it.” Another described witnessing their usage jump from 0% to 49% in a mere 12 minutes, despite having only performed a couple of prompts and a web search.
The concerns extended beyond Reddit. Another Claude user, experiencing their account burning through maximum tokens daily for three consecutive days without any personal use, escalated the issue by creating a GitHub report. This report further served as a gathering point for similar complaints, reinforcing the perception of a systemic vulnerability rather than isolated incidents.
Anthropic’s Broader Alert: Identifying and Warning Users
Crucially, some users who shared their experiences on GitHub posted emails they had received directly from Anthropic. These communications, to Anthropic’s credit, proactively identified and warned the users that their tokens were being stolen. The emails elucidated the nature of the threat: “We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers, then using those login sessions to access Claude accounts and consume their usage.”
Infostealer malware is a insidious category of malicious software designed to infiltrate a user’s computer and surreptitiously pilfer sensitive data, including saved passwords, browser session data, and login credentials. This type of malware often operates silently in the background, making detection challenging for the average user. When Anthropic’s systems detected suspicious activity linked to such breaches, the company responded by signing out the affected users, invalidating existing authorizations, issuing refunds, and advising them that their computers might be compromised. Anthropic also clarified that the malware itself did not originate from using Claude but could be acquired from various online sources, such as downloading infected software or clicking on malicious advertisements.
The Unanswered Questions: De Swardt’s Lingering Concerns
Despite Anthropic’s general alerts to other users, De Swardt himself did not receive one of these specific malware warning emails. This discrepancy added another layer of frustration for him. He maintained that he found no evidence of his computer being compromised, leaving him without a clear understanding of how the hackers gained access to his account. The ambiguity surrounding the breach source, coupled with the initial lack of itemized usage data, left him feeling vulnerable and unsupported.
His Claude account was eventually reinstated after approximately two weeks, a period of forced downtime that significantly impacted his business operations. However, the cumulative experience – the difficulty in obtaining swift and detailed assistance, the absence of granular usage tracking, and the lingering uncertainty about the security of his account – irrevocably soured his perception of Anthropic’s service.
Loss of Trust and a Shift in Allegiance
De Swardt ultimately canceled his Claude subscription. His decision was driven by a fundamental erosion of trust and a desire for greater control and transparency. He transitioned to Cursor, an alternative platform that offers the flexibility to utilize multiple AI models, including more cost-effective open-source options. His experience with these alternative models has been positive, leading him to conclude that “It’s not that much different or better” than Claude. He expressed little inclination to return to Anthropic’s service “without [Anthropic] actually having resolved the issue in any way.”
His primary contention remains the absence of user-accessible tools to monitor token consumption in detail. “I don’t think there’s any way that these people can protect themselves,” he asserted, highlighting a critical gap in user empowerment and security. When pressed for information on how users can proactively identify misuse, Anthropic declined to comment, a stance that further underscores the perceived lack of transparency.
The Imperative for Transparency: Itemized Billing in the AI Era
De Swardt’s experience, echoed by numerous other users, underscores a growing imperative for greater transparency in the billing and usage tracking of AI services. In an economy increasingly reliant on AI, where token consumption directly translates into financial cost, users need robust tools to monitor, audit, and secure their computational resources. The analogy to traditional utility bills is apt: just as consumers expect detailed breakdowns of their electricity or internet usage, AI users should be afforded similar visibility into their token consumption. Without itemized logs, identifying unauthorized activity, debugging inefficient prompts, or optimizing AI workflows becomes an impossible task, leaving users vulnerable to financial exploitation and security breaches.
This incident also shines a light on the broader challenges of securing cloud-based AI accounts. As AI services become more sophisticated and deeply integrated into daily operations, they become more attractive targets for cybercriminals. The use of infostealer malware to hijack login sessions represents a significant threat vector, requiring both robust security measures from service providers and enhanced vigilance from users.
Navigating the Evolving Cyber Threat Landscape for AI Users
The proliferation of infostealer malware targeting AI accounts signifies an evolving cyber threat landscape. Users of AI platforms must adopt heightened security hygiene, including:
- Multi-Factor Authentication (MFA): Implementing MFA whenever available adds a crucial layer of security beyond just passwords.
- Regular Password Changes: Frequent updates to strong, unique passwords are essential.
- Software Updates: Keeping operating systems, browsers, and antivirus software up to date can protect against known vulnerabilities exploited by infostealers.
- Cautious Downloads and Clicks: Exercising extreme caution when downloading files from untrusted sources or clicking on suspicious links is paramount.
- Security Software: Employing reputable antivirus and anti-malware solutions can help detect and prevent infections.
However, even with diligent user practices, the onus also falls on AI service providers to implement robust security architectures and provide tools that empower users to monitor their accounts effectively.
Broader Implications for AI Service Providers and User Security
The events surrounding Grant De Swardt’s Claude account breach carry significant implications for the wider AI industry. User trust is a fragile commodity, and incidents involving unauthorized access and opaque billing can severely erode confidence in AI platforms. In a highly competitive market, providers that prioritize transparency, user control, and robust security measures will likely gain a significant advantage.
The demand for itemized usage logs is not merely a convenience; it is a fundamental security and financial requirement for businesses and individuals leveraging AI. As AI becomes an indispensable utility, its providers must evolve their support systems and user interfaces to match the expectations of a sophisticated and security-conscious user base. Failure to do so risks alienating key segments of the market, potentially driving users to platforms that offer greater transparency and control over their valuable AI resources. The experience of Grant De Swardt serves as a stark reminder that as AI capabilities grow, so too must the security and accountability mechanisms that govern their use.
