Attention, everyone using Claude on a subscription: attackers are stealing login sessions and burning through other people's limits. In emails to affected users, Anthropic explained that the attacker uses a common infostealer that grabs Claude sessions directly from computers.
Here is how it played out for one of the victims. He has a Claude Max 20x subscription at $200 per month. On August 4 he noticed his limit draining, even though he hadn't worked that day. The next day he paused all his tasks, and usage still went up from 45% to 55%. Using the stolen session, the attacker issued new access tokens and worked under his name. Anthropic blocked the sessions and refunded part of the money, £44.49, but couldn't determine exactly how the access was stolen and didn't provide a detailed usage log, so he cancelled his subscription. TechCrunch reported the story on September 8; there are several victims, found through posts on Reddit and GitHub.
An infostealer usually lands on a computer bundled with an infected program or through a click on a malicious ad. This directly affects anyone building agentic pipelines: their machines constantly hold sessions and keys with access to paid services. If that's you, check your usage log and sign out of any sessions you don't recognize.
Who this is for:
- engineers and architects who use Claude in their projects and are responsible for security
- anyone whose AI limit or bill suddenly went up for no obvious reason
- anyone who wants to build resilient AI solutions, not just "launch a chatbot" to tick a box.