I read the TechCrunch piece about hackers draining Claude subscribers' tokens three times before I actually believed it, and then I went and checked my own usage dashboard like a paranoid person at 11pm on a Tuesday. (It was fine. Mostly fine. I'll get to the "mostly" part.)
Quick version for anyone who missed it: Anthropic confirmed that infostealer malware is grabbing active browser sessions off infected computers and replaying them to mint unauthorized Claude Code OAuth tokens. The case TechCrunch led with was a guy named Grant De Swardt, a Claude Max 20x subscriber, whose usage shot up while he wasn't even at his computer. Anthropic eventually told him the culprit was a compromised session key being used to generate tokens he never asked for. There's also a Reddit post floating around where someone says their usage went from 0 to 49% in twelve minutes after nothing more than a couple of prompts and a web search that morning. Twelve minutes!
I use Claude Code pretty much every day for work at this point, and I'm not exaggerating when I say it's become the thing I reach for before I even open a terminal manually anymore. So the part of this that actually got under my skin isn't the malware itself, its that Anthropic apparently can't tell most affected subscribers what consumed their tokens or how the attacker got in in the first place. Account support tracks total usage, not itemized usage, even when you ask. Which means if youre on a flat-rate plan and your number creeps up a little, you have genuinely no way to tell the difference between "I had a long debugging session" and "something is quietly draining my account in the background." That gap is the actual story here, not the malware. Malware stealing session cookies isnt new or even that interesting on its own. A vendor that cant itemize usage when a customer explicitly asks is a design choice, and its one that makes this kind of theft invisible by default instead of a one-off incident you catch quickly.
To Anthropic's credit, the response for confirmed cases sounds reasonable: sign the user out everywhere, strip saved payment methods, refund the unauthorized charges. That's the right triage. But triage only kicks in once you've already noticed something's wrong, and if your usage pattern is naturally spiky (mine absolutely is, I'll go quiet for two days then burn through a huge chunk of my quota in one caffeinated afternoon rewriting a build script that didn't need rewriting), a stolen session could hide in that noise for a long time before anyone, you or Anthropic, flags it.
So here's what I actually did after reading this, in case it's useful to anyone else running Claude Code day to day:
- Went through every active session in my account settings and killed anything I didn't immediately recognize. There were two I couldn't place and just nuked them out of caution.
- Turned on whatever extra login alerting was available, even though it's not much.
- Started actually glancing at the usage graph instead of ignoring it until the monthly reset, which I'll admit I used to do maybe once a month if that.
- Ran a malware scan on my main dev machine, found nothing, felt briefly smug, then remembered that's exactly what everyone says right before they find something.
None of that is a real fix. It's just the stuff an individual user can do while waiting for the platform side to catch up, and honestly it shouldn't be on us to reverse-engineer our own session logs to catch this. I don't think this is some uniquely Anthropic problem either, Claude is just the one that made headlines this week, and I'd bet every AI vendor selling token-metered subscriptions has some version of this exposure sitting there unaddressed. Session hijacking has been a solved-ish problem in web security for years in the abstract, but "solved in the abstract" and "solved for a product that got popular eighteen months ago and is still bolting on account infrastructure" are very different things.
If you're on Claude Max or any paid Claude tier, go look at your active sessions right now. It takes two minutes and at worst you feel silly for finding nothing.