Archive — US — techcrunch
Hackers are stealing Claude tokens from subscribers
On August 4, Grant de Swardt's Claude Max 20x account showed unusual token usage despite inactivity. After investigation, Anthropic found that hackers accessed his account using a compromised session key to misuse tokens. This incident highlights vulnerabilities in account security, leading users to share concerns about unauthorized access on platforms like Reddit. De Swardt subsequently canceled his subscription due to insufficient support and protection from such issues.
Key points
- Grant de Swardt noticed a 10% increase in token usage without activity on August 4.
- After contacting Anthropic, they suspended his account, invalidated sessions, and issued a partial refund.
- Investigation revealed unauthorized third-party access due to a compromised session key.
- De Swardt learned other users experienced similar issues, with reports of unexplained token usage.
- Anthropic confirmed the use of infostealer malware for unauthorized access, but de Swardt found no evidence of malware on his computer.
- Lack of itemized token usage tracking prevented early detection of token theft.
- De Swardt canceled his subscription, citing inadequate user protection and support from Anthropic.
Why it matters
- This incident aligns with ongoing concerns about cybersecurity in AI tools, especially regarding session management and malware threats.
- The rise of infostealers highlights a growing trend in cyber threats targeting subscription-based online services.
- As AI tools become more integrated into business operations, user security and monitoring mechanisms are critical for maintaining trust.
The incident faced by Grant de Swardt underscores the need for improved security measures and transparency from AI service providers like Anthropic to protect users from unauthorized access and token theft.