Reports of stolen Claude sessions are showing how quickly a compromised browser login can become unauthorized AI coding usage. Subscribers have seen their allowances consumed while their accounts were idle, with Anthropic attributing at least some incidents to stolen session data and Claude Code access tokens created without the account holder’s permission.
Software developer Grant De Swardt noticed the usage on his Claude Max 20x plan rise from 45 percent to 55 percent during a controlled period when he was not using the service. The plan cost $200 a month. His observation did not identify the attacker, but it gave him a simple signal that another process was consuming his allocation.
A Browser Session Became Coding Access
Anthropic suspended De Swardt’s account, invalidated active sessions and revoked server-side Claude Code OAuth tokens. The company also issued a partial refund of £44.49. According to the explanation reported by TechCrunch, a compromised session key had been used to mint unauthorized OAuth tokens, and the account was accessed through a third-party service.
The source does not establish how the original session key was obtained. Other users on Reddit and GitHub have described similar unexpected consumption. Emails from Anthropic cited in the article say common information-stealing malware can capture login sessions and use them to consume Claude allowances. The company warned that such malware does not come from Claude itself.
That explanation describes a familiar security boundary: a service may correctly recognize a valid session even when the person presenting it is not the subscriber. If the stolen session can create longer-lived coding credentials, a single compromise can continue beyond ordinary browser activity. Revoking both sessions and OAuth tokens is therefore necessary containment.
The Evidence Still Leaves an Attribution Gap
De Swardt says he found no evidence that his device had been compromised. That does not prove the absence of malware, but it means the precise entry point remains unresolved in his account. Anthropic reinstated him after two weeks, and he later canceled his subscription.
The available evidence supports a narrow conclusion: unauthorized usage occurred, Anthropic identified a compromised session key and revoked related access. It does not show who stole the session, which system first exposed it or whether every similar complaint has the same cause. Anthropic declined to comment to TechCrunch on how it distinguishes malicious use from legitimate activity.
The lack of itemized usage made the experience harder to investigate. A percentage meter can reveal that capacity disappeared, but it cannot show which credential initiated a task, when the token was created or what category of client used it. More detailed records would not prevent theft, yet they could help a subscriber recognize an anomaly and help support teams explain their response.
Account Security Needs Product-Level Visibility
Anthropic’s actions—signing out sessions, invalidating authentication and issuing refunds—addressed the immediate harm described in the article. The reports suggest that subscribers also need controls before usage accelerates: a list of active sessions and OAuth grants, timestamps for token creation, one-click revocation and alerts when a new client begins consuming an unusual share of the plan.
Those controls must avoid exposing sensitive prompt content. Useful security telemetry can identify a device, credential type and amount of usage without displaying the work itself. Clear records would also let users separate an unexpectedly expensive legitimate task from access they did not authorize.
The incidents are not evidence that Claude generated the malware or that Anthropic’s model was breached. They concern account credentials at the boundary between a browser session and Claude Code. That boundary deserves attention because subscription capacity has financial value and can be converted into computing work elsewhere. As AI services connect web accounts to developer tools, protecting the handoff between them becomes as important as protecting the model endpoint itself.
