TL;DR: On August 4, 2026, an AI consultant noticed his Claude Max 20x tokens being consumed with no work on his part. Anthropic confirmed the cause: infostealer malware stole his Claude session key, which was used to mint unauthorized Claude Code OAuth tokens. Anthropic has no itemized usage log that lets customers detect the theft from normal usage. Reddit and GitHub show dozens of similar cases. Five controls your enterprise Claude Code deployment needs before the next incident.
On August 4, 2026, Grant De Swardt, an AI consultant based in East Sussex, U.K., noticed something wrong with his Claude Max 20x account. He had not been working. His token usage was rising.
He ran a controlled test: on August 5, he disabled every automated task, paused scheduled Cowork jobs, disabled Dispatch and cloud execution, and confirmed no active local Claude Code tasks. Tokens continued to disappear. "In the clearest controlled interval, it increased from 45% to 55% while I performed no work," he told TechCrunch.
De Swardt contacted Anthropic and asked for an itemized usage log. Anthropic did not provide one. What it found instead was the attack: a compromised Claude session key had been used to mint unauthorized Claude Code OAuth tokens, which a third party was using to consume his account.
Anthropic suspended his paid account, invalidated his sessions and server-side Claude Code tokens, and issued him a partial refund of £44.49 on his £200-per-month subscription. His account was offline for roughly two weeks.
When De Swardt posted his experience on Reddit, 80 comments arrived from users describing similar incidents. A separate GitHub issue on the anthropics/claude-code repository (issue #82506) surfaced more affected accounts. Two users in those threads shared emails from Anthropic that named the attack vector directly.
"We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people's computers, then using those login sessions to access Claude accounts and consume their usage," the Anthropic email read.
How the attack works
Infostealer malware is a category of credential-harvesting software that installs itself on a target's computer and extracts saved passwords, session cookies, and authentication tokens. It can arrive through infected software downloads, malicious advertisements, or phishing links. The malware itself has nothing to do with Claude -- it targets the user's machine, not Anthropic's infrastructure.
Once infostealer malware extracts a valid Claude session key, the attacker can use it in two ways. First, they can directly consume the victim's token allowance by sending requests as if they were the account holder. Second -- and this is the more significant capability -- a stolen session key can be used to mint new Claude Code OAuth tokens, creating persistent authorization credentials that survive a password change.
This second step is what happened in De Swardt's case. The attacker was not just replaying his session; they were creating new OAuth tokens that gave them independent, ongoing access. Anthropic's response -- signing him out and invalidating existing authorizations -- addressed this by revoking those tokens. But without an itemized log, neither De Swardt nor Anthropic could determine exactly what the attacker had done with that access.
Anthropic confirmed to TechCrunch that the malware did not originate from using Claude. The company did not comment publicly on the full scope of affected accounts or whether the attack was part of an organized campaign.
The audit gap
De Swardt's case reveals a structural problem with how AI platforms handle usage transparency. Standard billing tracks aggregate token consumption. It does not distinguish between requests made by you, requests made by your agents, and requests made by an attacker using your credentials. All appear in the same total.
"I don't think there's any way that these people can protect themselves," De Swardt said.
This gap matters particularly for enterprise teams. A developer running Claude Code in a production environment may be authorizing dozens of agents, scheduled tasks, and API calls in any given day. A usage spike from an attacker who has compromised that developer's session would be difficult to separate from a legitimate spike caused by a new agent or an unusually complex task.
Anthropic does provide a billing dashboard with total token usage, and some account tiers show usage by model. But there is no per-request log available to account holders, no webhook for usage anomalies, and -- as De Swardt's case shows -- no standard procedure for producing one on request, even during an active incident investigation.
5 controls for enterprise Claude Code deployments
The attack vector here is infostealer malware on a developer's endpoint, not a vulnerability in Claude Code itself. The appropriate response is a combination of endpoint security, credential hygiene, and monitoring -- not abandoning Claude Code.
1. Treat developer endpoints as production attack surface.
The infostealer malware in this incident targeted the session key stored on the developer's machine, not Anthropic's servers. Every developer with Claude Code access is a potential credential exfiltration point. Ensure developer machines have endpoint detection and response (EDR) software, managed device policies (MDM), and that Claude session keys are not stored in plaintext outside the application's secure credential store. The same security standards you apply to production servers apply to the laptops that have session keys to those servers' tooling.
2. Audit active Claude Code OAuth tokens on a schedule.
When a stolen session key is used to mint new OAuth tokens, those tokens persist until explicitly revoked. Run a periodic review of which OAuth tokens are active in your Claude Code accounts. Revoke any token that cannot be attributed to a specific authorized agent or user. If Anthropic does not yet provide a self-service OAuth token inventory in the account dashboard, contact your account representative to request one or establish a process for token rotation.
3. Set up usage monitoring with anomaly alerting.
Itemized logs are not available, but aggregate consumption is. Set up monitoring on your Anthropic billing dashboard or API usage endpoint and alert when consumption exceeds a baseline by a significant margin -- 20% above the rolling 7-day average is a reasonable starting threshold. The attack in De Swardt's case caused tokens to increase by 10 percentage points over a controlled, idle period -- a spike that an automated alert would have caught within hours.
4. Rotate Claude Code session credentials on a defined schedule.
Session keys and OAuth tokens have longer effective lifetimes than is typical for production secrets. Establish a rotation policy: session credentials should be cycled at defined intervals (monthly is a starting point; quarterly maximum) and immediately when a team member leaves or a device is lost or suspected compromised. Add Claude Code token rotation to your existing offboarding checklist alongside GitHub and cloud provider credentials.
5. Separate agent credentials from developer credentials.
In De Swardt's case, the attacker gained access through a developer's personal session key. If your production agents share credentials with developer sessions, a compromised developer account is a compromised agent account. Create dedicated service accounts or API keys for production Claude Code deployments, separate from any human developer's personal account. Scope those service accounts to the minimum necessary permissions and rotate them independently of developer credentials.
What Anthropic should add
The five controls above address what enterprise teams can do now, within the constraints of Anthropic's current tooling. But the incident also identifies specific gaps in Anthropic's own audit capabilities.
The core missing feature is an itemized usage log: a per-request record that shows which credential authorized each API call, what the request contained (or a hash of it), and the resulting token consumption. This is standard practice for cloud providers, payment processors, and any service where credential theft has financial consequences. Without it, account holders have no reliable way to determine whether an anomalous usage spike represents legitimate agent activity, a runaway loop in their own code, or an external attacker.
A secondary missing feature is an anomaly webhook: a notification pushed to account holders when usage deviates significantly from baseline. Anthropic proactively identified and warned some affected users in this incident -- which indicates the company has internal usage monitoring. Making that monitoring available to account holders as a configurable alert would let affected users respond in hours rather than days.
De Swardt cancelled his Claude subscription after the incident. His experience -- a two-week account suspension, no itemized records, a partial refund -- represents the current cost of a compromised session for a sole proprietor. For an enterprise team with dozens of developers and hundreds of agent sessions, the same incident would be proportionally harder to contain and attribute.
For related coverage on API token incident response and agentic AI security, see the AI agent API token leak incident response guide, the AI account takeover risk guide, and the vetting AI tools for malware and typosquatting.
Related Reading
- AI agent API token leak: incident response guide 2026
- AI support chatbot account takeover risk guide
- Jadepuffer agentic ransomware: AI vendor security checklist
- TypeScript AI agent security incident response playbook
- Vetting AI tools for fake malware and typosquatting 2026
- OpenAI agent escapes: vendor disclosure gap and 5 contract questions
- Claude Code source leak: AI governance lessons for small teams
- AI supply chain security checklist 2026
