> ## Content Index
> Fetch the complete content index at: https://www.metatalks.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# Malware is draining Claude subscribers’ token allowances
- URL: https://www.metatalks.ai/anthropic-says-malware-is-stealing-claude-logins-and-draining-users-token-allowances/
- Published: 2026-09-10T08:18:00.000Z
- Updated: 2026-09-10T08:17:59.000Z
- Author: Al
- Tags: News, AI Security, #newswire

**The company has logged affected customers out, canceled their authorizations and refunded some, but declined to explain how subscribers can spot unauthorized usage.**

In emails published by two recipients, Anthropic warned that an attacker was using infostealer malware to drain Claude subscribers' paid usage. The software harvests saved credentials from infected computers. The company said the malware did not come from using Claude.

AI consultant and Claude Max subscriber Grant De Swardt told [TechCrunch](https://techcrunch.com/2026/09/08/hackers-are-stealing-claude-tokens-from-subscribers/?ref=metatalks.ai) his usage rose from 45% to 55% while he did no work, with scheduled jobs halted or finished, cloud execution disabled and no matching task running on his computer. He first noticed unexplained consumption on August 4 and disabled his integrations the next day.

Anthropic later told him a compromised session key had been used to create unauthorized Claude Code OAuth tokens. An outside service appeared to be using his account to run work for other people, but the company could not establish how it gained access.

De Swardt said he found no evidence his computer had been compromised. He did not receive one of the malware warning emails.

His account was suspended during the investigation, and access returned after about two weeks. He told TechCrunch the suspension disrupted his business, which relied on agents for administration, website design and coding.

Other users reported similar problems on Reddit and in [a GitHub issue](https://github.com/anthropics/claude-code/issues/82506?ref=metatalks.ai), including one who said their account hit its usage ceiling for three consecutive days without being used.

Support staff track total consumption but cannot provide an itemized breakdown, even on request. De Swardt asked for one and never received it.