Hackers are stealing Claude tokens from subscribers

Hackers are stealing Claude tokens from subscribers

One morning in August, an AI consultant in the UK watched his Claude token balance drain — while he sat completely idle. No tasks running. No agents firing. Just a number ticking upward on its own. Hackers are stealing Claude tokens from subscribers, and the mechanics of how they do it should put every developer running AI-powered workflows on high alert — especially in Asia, where AI adoption is accelerating faster than security culture can keep pace.

What Happened

The story starts with Grant de Swardt, an independent AI consultant based in East Sussex, UK, who runs a $200-per-month Claude Max 20x subscription. According to TechCrunch's reporting by Julie Bort, de Swardt first noticed the anomaly on August 4: his token usage was climbing even though he hadn't touched Claude that day. The following day, he ran a controlled test — paused all scheduled tasks, disabled Dispatch and cloud execution, confirmed no active local Claude Code tasks were running — and watched his usage jump from 45% to 55% anyway.

He contacted Anthropic and asked for an itemized breakdown of what was consuming his tokens. Anthropic couldn't provide one. What it could do was confirm something was wrong: it suspended his account, invalidated all active sessions and server-side Claude Code tokens, and issued him a partial refund of £44.49 for the remaining subscription period.

After investigation, Anthropic told de Swardt what had actually happened. A compromised Claude session key had been used to mint unauthorized Claude Code OAuth tokens. An unknown third party had obtained access to his account and was silently routing other users' activity through it — burning through his token allowance in the process. Anthropic told him the evidence was "consistent either with credentials/session data being taken without my knowledge, or with the account having been connected to an outside service."

The attack vector here is subtle and worth unpacking. This wasn't a brute-force login. It was session key theft — a compromised credential used to generate OAuth tokens that look legitimate to Anthropic's systems. Because Anthropic tracks total token usage but not itemized per-request usage (even when customers explicitly ask), this kind of covert siphoning could run undetected for months. For de Swardt, the account suspension — necessary as it was — also shut down the agents he relies on for his entire business operation: client onboarding, accounting automation, daily admin, coding. The security fix became its own operational crisis.

Why It Matters for Asia

Southeast Asia, India, Japan, and South Korea are collectively among the fastest-growing markets for AI developer tooling right now. Founders in Jakarta, Ho Chi Minh City, Bangalore, and Seoul are building agent-heavy products at a pace that often outstrips their security infrastructure. That gap is exactly what attackers exploit.

The threat profile in Asia has some specific characteristics worth naming. First, API key and session token hygiene is inconsistently practiced across the region's startup ecosystem. Many early-stage teams share credentials across environments, store keys in plaintext config files, or use personal accounts for production workloads — habits that create exactly the kind of exposure de Swardt experienced. Second, the economics of AI subscriptions make token theft genuinely profitable. A $200/month Claude Max account represents significant purchasing power in many Asian markets. Stolen token capacity can be resold or used to run inference workloads at zero cost to the attacker.

Third — and this is the part that should concern founders most — the lack of itemized usage logging means the attack surface is invisible until the damage is done. If you're running a startup in Singapore or Bangkok and your team's Claude usage spikes 30% in a week, you'll likely attribute it to a product sprint, not credential theft. The signal is too easy to explain away.

From an Asia tech perspective, this incident also surfaces a broader tension: the region's developer community has embraced AI tooling with remarkable speed, but the security frameworks that enterprise teams in the US and Europe apply to their API credentials haven't followed at the same pace. Threat actors know this. Token theft is low-effort, high-reward, and — as this case demonstrates — difficult to detect and even harder to attribute.

For teams building on MonstarX, Asia's AI-native dev platform, the lesson is structural: treat every AI session token with the same seriousness you'd apply to a database password or a cloud IAM role. The blast radius of a compromised AI credential is no longer theoretical.

What This Means for Developers

The de Swardt incident isn't a freak occurrence — it's a preview of a threat category that will scale as AI subscriptions become standard infrastructure for development teams. Here's what developers need to think about concretely.

Session tokens are credentials. Treat them that way. The attack worked because a session key was compromised and then used to mint additional OAuth tokens. If you're using Claude Code, Claude API, or any AI service that issues session-based credentials, those tokens need to live in secrets management systems — not in environment files, not in shell history, not in shared Notion docs. Tools like HashiCorp Vault, AWS Secrets Manager, or even a well-configured .env setup with proper .gitignore hygiene are non-negotiable.

Monitor your usage like you monitor your cloud spend. One of the most alarming details in this story is that Anthropic couldn't provide itemized usage data even when asked. That means the monitoring burden falls entirely on you. Set up automated alerts for token consumption anomalies. If your daily average is 10,000 tokens and you suddenly spike to 40,000 on a Sunday when no one's working, that's a signal worth investigating immediately — not next sprint.

Rotate credentials aggressively. OAuth tokens and session keys should have short TTLs (time-to-live). If your workflow allows it, rotate API keys on a regular cadence — weekly or bi-weekly for production environments. The longer a credential lives, the longer an attacker has to exploit it undetected.

Scope your tokens tightly. If a Claude Code token only needs read access to a specific project, don't issue it with broader permissions. Principle of least privilege applies to AI credentials exactly as it does to database users and cloud roles. A stolen token with narrow scope does limited damage; a stolen token with full account access can drain your entire monthly allowance in hours.

Audit third-party integrations ruthlessly. Anthropic's investigation suggested de Swardt's account may have been connected to an outside service that obtained access without his knowledge. If you've ever authorized a third-party tool, browser extension, or automation platform to access your AI accounts, audit those connections now. Revoke anything you don't actively use. The OAuth permission screen you clicked through six months ago during a late-night hackathon might still have live access to your production account.

For teams building agent pipelines with multiple connectors and external service integrations, the credential surface area multiplies quickly. Each integration point is a potential entry vector. Mapping your token exposure across the full agent stack — not just the primary AI provider — is the kind of security hygiene that prevents a Grant de Swardt situation from becoming your situation.

Key Takeaways

The Claude token theft story is a clean case study in a new category of attack: AI credential abuse. It's not about breaking encryption or exploiting a zero-day. It's about quietly obtaining a session key and using it to consume a resource that the legitimate owner is paying for. The victim loses money and operational continuity. The attacker gets free AI compute. The platform struggles to even produce the audit trail needed to understand what happened.

A few things are true simultaneously here. Anthropic handled the incident responsibly — it investigated, confirmed the breach, suspended the account, and issued a partial refund. But the lack of itemized usage logging is a genuine product gap that makes this class of attack harder to detect and respond to. Providers across the AI stack need to build better observability tooling for their customers, not just for their own infrastructure teams.

For developers, the actionable summary is this:

• Store AI session tokens in secrets managers, never in plaintext files or shared documents.
• Set consumption alerts for every AI account your team uses — personal and organizational.
• Rotate credentials on a regular schedule; don't wait for a breach to prompt it.
• Audit and revoke unused third-party OAuth connections on a monthly basis.
• Apply principle of least privilege to every token you issue, regardless of the AI provider.
• Document your token exposure across the full agent stack, not just the primary API.

De Swardt's account suspension cost him days of operational downtime and disrupted client work he couldn't easily recover. For a solo consultant, that's painful. For a funded startup running production agents at scale, the same incident could be catastrophic — both financially and reputationally. The threat is real, the detection is hard, and the prevention is mostly straightforward engineering hygiene that too many teams skip.

The deeper issue this surfaces is one the AI industry hasn't fully confronted yet: as AI subscriptions become core infrastructure — as essential to a developer's workflow as a cloud compute account or a database — the security standards applied to them need to match. Right now, they don't. That gap is what attackers are walking through.