Hackers Are Stealing Claude Tokens From Subscribers
An independent AI consultant watched his Claude Max 20x allowance burn through 55% while he did no work at all — and Anthropic's response was to suspend his account rather than explain where the tokens went.
Published: 2026-09-09 Category: Quick Take Sources: TechCrunch
The mystery consumption
On August 4, Grant De Swardt, an independent AI consultant in East Sussex, U.K., noticed his Claude Max 20x account burning tokens even though he wasn't working that day. The next day he disabled everything attached to Claude and stopped using it — and the consumption kept climbing. In his cleanest controlled interval it rose from 45% to 55% of his allowance while he performed no work, Cowork tasks were paused or completed, and Dispatch/cloud execution was disabled.
De Swardt asked Anthropic for an itemized breakdown of what was eating his tokens. Anthropic wouldn't provide one but agreed something was off. It suspended his paid account, invalidated all sessions and server-side Claude Code tokens, and issued a partial refund of €44.49 for the remainder of his $200-per-month subscription. The suspension hit his business hard: he helps small and mid-size companies stand up agents — a kind of forward-deployed engineer for hire — and the account freeze knocked out the tooling his clients depended on.
What the pattern suggests
The most plausible explanation for "usage with no work" is stolen or leaked credentials. Anthropic invalidating server-side Claude Code tokens strongly implies the account had been compromised — that someone else was using De Swardt's allocation, likely through an exposed API key or a session token lifted from a toolchain. The fact that disabling his own attachments didn't stop the drain points to a credential living outside his direct control, not a misbehaving local client.
This is a quiet but serious class of incident. Claude Max 20x is a high-end subscription, and the people who buy it tend to chain it into agent frameworks, CI pipelines, and cloud execution environments — exactly the places where credentials sprawl and get forgotten. A leaked token there isn't just a billing problem; it's an exfiltration risk if the same credential can read or write the user's projects and data.
The trust problem
Anthropic's refusal to itemize is the part that should worry users more than the hack itself. When a subscriber reports anomalous usage and the provider responds by refunding and suspending without a forensic breakdown, it converts a security incident into an opaque billing dispute. The victim never learns which credential leaked, meaning the same exposure could recur on a new account.
The lesson for anyone running heavy agent workloads is blunt: treat your model tokens as sensitive credentials, rotate them, scope them, and monitor usage as a security signal rather than just a cost center. And if the platform can't tell you what happened after invalidating your sessions, that gap is itself the story.
Source: TechCrunch, "Hackers are stealing Claude tokens from subscribers" by Julie Bort (2026).