Claude, stolen sessions and tokens consumed without consent: the new frontier of AI security

For those who use an AI assistant every day, the token counter has become something very tangible: it indicates how much work can still be done, how much it costs to continue, and, in higher-tier plans, how much value remains in a subscription. This is why some Claude users grew alarmed when they saw usage climbing even while they were not using the service. It was not just a billing issue. In at least some cases, behind those numbers lay unauthorized access.

TechCrunch gathered several accounts from Claude Max subscribers who noticed sudden spikes in usage with no activity traceable back to them. In one documented case, a British AI consultant watched his consumption rise even after pausing tasks, disabling connected services, and stopping work with Claude. Following an investigation, Anthropic reportedly informed him that a compromised session key had been used to generate unauthorized Claude Code OAuth tokens.

There is no need to steal the password if you can steal the session

The technical point is important. When a user logs into a service, the system does not ask for their password on every single action. After authentication, tokens and sessions are created that allow the browser, apps, or connected tools to keep operating. If one of these elements is stolen, an attacker can in some cases reuse it to act as an already authenticated user, without necessarily needing to know the original password.

According to Anthropic communications reported by users, some of the incidents were linked to common infostealers, malware designed to harvest saved passwords, cookies, session data, and other credentials stored on a computer. It is a family of threats that has existed for years, but one that becomes even more critical when the compromised account grants access not just to an email inbox or social network: it can open the door to an AI agent capable of executing code, using tools, browsing files, and consuming expensive resources.

According to TechCrunch's reporting, Anthropic responded in some cases by invalidating sessions, logging users out, issuing refunds, and warning of the possible presence of malware. The issue, however, does not seem to come down to the simple question, “was the password stolen?” The ecosystem surrounding Claude includes browsers, desktop apps, Claude Code, extensions, and OAuth permissions: each new integration point makes the product more useful, but also increases the number of credentials that must be properly managed and revoked.

The most serious problem is understanding what is consuming the tokens

One of the critical issues emerging from user accounts is the lack of granularity in how usage is displayed. Seeing that consumption has risen does not necessarily mean understanding which session, device, or authorization generated that activity. For an average user, this is annoying; for those who rely on Claude as a professional work tool, it can become a serious operational issue.

In the case reported by TechCrunch, the professional involved requested an activity breakdown explaining which processes had consumed the quota. He reportedly did not receive a full account. This creates a paradoxical situation: the system can detect that anomalous usage has occurred and take security measures, yet the user may lack the tools to independently reconstruct the incident.

The more autonomous AI agents become, the more central this type of traceability becomes. It is not enough to know that “Claude used 20% of the quota.” One needs to be able to understand which client operated, with what authorization, from which device, what tools it invoked, and within what timeframe. It is the same principle that has guided mature enterprise systems for years: detailed logs, audit trails, and the ability to selectively revoke access.

Global logout is not always the end of the story

Anthropic already provides a feature to log out of all active sessions and allows authorization tokens for Claude Code to be managed separately. In theory, these are precisely the tools a user should turn to following suspicious access.

However, matters get more complicated when different integrations enter the picture. In a public report on GitHub, a user documented an instance where the official Claude for Chrome extension reportedly remained authenticated even after a global logout, while its authorization was not visible among normal Claude Code tokens. The report does not prove that this was the cause of the unauthorized consumption incidents, and must therefore be treated as a technical hypothesis to be verified. Yet it clearly highlights the broader issue: in an ecosystem full of tokens, extensions, and agents, the concept of “log out of all devices” must truly encompass everything.

Why AI agents raise the stakes

With traditional chatbots, a stolen account primarily allowed someone to read conversations or generate new responses. With next-generation agents, the attack surface is different. Claude Code can operate inside repositories, edit files, and execute commands. Other agentic systems can connect to email, calendars, documents, browsers, and enterprise services. The value of an authenticated session grows right alongside the agent's capabilities.

This means security can no longer be treated as an interface add-on. Session management becomes as much a part of the product as the model itself. Immediate revocation, device recognition, notifications for new authorizations, spending limits, readable logs, and anomaly detection must become standard features, especially for users entrusting continuous or semi-autonomous processes to AI.

There is also an economic dimension. Higher-tier AI plans can provide access to vast amounts of compute. If a credential is stolen, it is not just an account being compromised: computational capacity already paid for by someone else is siphoned off. It is a form of abuse that, in some ways, resembles the theft of cloud credits or API keys, yet made more opaque because usage flows through consumer products and monthly subscriptions.

What a Claude user can do today

Anyone noticing unexplained consumption should treat it as a potential sign of compromise and not merely a counter glitch. Terminating all active sessions, revoking unnecessary Claude Code tokens, reviewing connected extensions and applications, and checking for malware are the first sensible steps. It is also wise to secure the Google account or email address used for login, as AI protection inevitably relies on safeguarding the upstream identity.

The burden, however, cannot fall entirely on users. If AI assistants are to evolve into everyday infrastructure, they must offer security tools up to the standard of the role they are assuming. An agent capable of working autonomously must also be extremely easy to stop, isolate, and inspect.

The next battle for AI will also be over trust

Over the past two years, competition among OpenAI, Anthropic, Google, and other leading labs has focused on benchmarks, reasoning capabilities, speed, and autonomy. But the more AI embeds itself into real-world workflows, the more the difference between an intriguing product and a reliable one shifts toward seemingly less flashy details: who can access it, which permissions remain active, how straightforward it is to understand what happened, and how quickly anomalous behavior can be halted.

Instances of tokens drained without consent are therefore more than a technical curiosity. They are a reminder of what happens when AI stops being just a chat window and becomes an operating system for digital work. At that point, securing the session also means protecting everything the agent can do on our behalf.