Grant de Swardt, an independent AI consultant in East Sussex, noticed unusual token consumption on his Claude Max 20x account despite being inactive. He disabled all connected tasks and scheduled work, yet the usage still climbed. De Swardt reported that during a controlled interval with no active tasks, token consumption increased from 45% to 55%.
Upon contacting Anthropic for an itemized list, the company suspended the account, invalidated server-side tokens, and issued a partial refund of £44.49. De Swardt explained that this suspension severely impacted his business, which relies on AI agents for daily admin tasks, website design, and coding.
Anthropic identified a compromised session key being used to mint unauthorized Claude Code OAuth tokens. The company suggested the account may have been connected to an outside service or that credentials were stolen without his knowledge. This type of theft could go undetected for months due to a lack of itemized usage tracking.
Reddit users reported similar incidents, with accounts auto-upgraded or burning through tokens immediately. Anthropic warned customers that a bad actor was using infostealer malware to steal sessions from computers. While de Swardt found no malware on his machine, the account was ultimately reinstated. However, the lack of tools to monitor token usage led him to cancel his subscription in favor of Cursor.
The Editorial Staff at AIChief is a team of professional content writers with extensive experience in AI and marketing. Founded in 2025, AIChief has quickly grown into the largest free AI resource hub in the industry.