Grant de Swardt, an independent AI consultant in East Sussex, UK, said his Claude Max 20x account consumed tokens while he was not using it. Anthropic suspended the paid account, invalidated its sessions and server-side Claude Code tokens, and refunded £44.49 from his $200-per-month subscription after finding that a compromised Claude session key had been used to mint unauthorized Claude Code OAuth tokens. The company said an unauthorized third-party service appeared to be handling activity for other people, though it could not determine how access was obtained. Similar reports on Reddit and GitHub described accounts being upgraded or rapidly consuming their allowances without user activity. Anthropic later warned some users that infostealer malware (software that steals passwords and session data) was taking Claude login sessions from their computers, while saying the malware did not originate from Claude use. De Swardt’s account was restored after about two weeks, but he canceled in favor of Cursor, citing slow support and the absence of itemized usage data. Anthropic declined to explain how users can identify misuse.