Hackers are using stolen Claude login sessions to run work through other people’s paid accounts, according to a September 8 TechCrunch report. Emails shared by affected subscribers describe attackers taking session data with infostealer malware and using it to consume the victims’ usage allowances.
AI consultant Grant De Swardt noticed his Claude Max usage climbing while he was not working. Anthropic later told him that a compromised session key had been used to create unauthorized Claude Code access tokens, and that an outside service appeared to be running activity for other people through his account.
How that service obtained his session remains unresolved. Anthropic described evidence consistent with either stolen credentials or an account connected to an outside service. De Swardt said he found no sign of malware on his computer. The warnings sent to other subscribers therefore do not establish the entry point in his case.
Anthropic suspended his account, invalidated sessions and Claude Code authorizations, and issued a partial refund. His access was restored after roughly two weeks. For his consulting business, the disruption extended beyond the missing allowance: the tools he used for client automations and daily operations were unavailable.
Other users reported similar unexplained usage, but a rising meter alone does not prove theft. The report highlights the difficulty of investigating it when a subscriber can see total consumption without an itemized account of the work that used it.