In early August, Grant De Swardt, an AI consultant from the U.K., noticed unexplained increases in token consumption on his Claude Max 20x account despite not actively using the service. After disabling all integrations and pausing tasks, his token usage continued to rise, prompting him to contact Anthropic for clarification. While the company did not provide a detailed usage breakdown, it acknowledged suspicious activity, suspended his account, invalidated session tokens, and issued a partial refund. Anthropic later identified that a compromised Claude session key had been exploited to generate unauthorized OAuth tokens, allowing a third party to consume tokens illicitly. This breach appears linked to malware known as infostealers, which harvest saved passwords and session data from infected devices. Multiple Claude users have reported similar unauthorized token drain incidents, some experiencing rapid and unexplained spikes in usage. Anthropic has responded by signing out affected users, invalidating authorizations, issuing refunds, and advising users to check for malware, though it emphasized that the malware is not related to Claude itself. The lack of detailed token usage visibility complicates detection and prevention of such abuses. De Swardt, frustrated by the incident and limited support, canceled his subscription in favor of alternative AI platforms offering more transparent usage monitoring. Anthropic has not provided further guidance on identifying or mitigating misuse, leaving users concerned about protecting their accounts from similar attacks.