Anthropic's Claude platform is facing fresh attention after users reported unusual token consumption on paid accounts. In one case, independent AI consultant Grant de Swardt noticed his Claude Max 20x usage rising even when he was not actively working.
After de Swardt asked Anthropic for a detailed breakdown, the company did not provide itemized usage, but it did confirm that something was wrong. His paid account was suspended, sessions were invalidated, server-side Claude Code tokens were reset, and he received a partial refund.
Anthropic later said a compromised session key had been used to generate unauthorized Claude Code OAuth tokens. The company explained that a third party appeared to be using the account through stolen login sessions, while also warning that similar cases may involve infostealer malware on a user's device.
Other Claude subscribers described similar spikes in token use, with some saying their accounts reached maximum usage without their involvement. A number of users also shared related experiences in public developer discussions, suggesting the issue may be affecting more than one account.
De Swardt, who uses AI tools to support business operations such as admin work, coding, and website tasks, said the incident pushed him to move away from Claude and toward platforms that offer broader model access. He also pointed to a key limitation: users still cannot easily see exactly what is consuming their tokens.
The episode highlights how AI services are becoming central to daily work, while also underscoring the need for stronger account visibility and security tools. As AI adoption expands, clearer usage controls could become a defining feature of trusted digital platforms.
