TechCrunch AI · Published 2026-09-09
Unexpected Claude usage traced to compromised session credentials
A Claude Max user’s allowance kept falling after he stopped his tasks. TechCrunch traces the unexpected activity to compromised session credentials and reports a gap in itemized usage visibility.
Usage rose from 45% to 55% while work was stopped
UK consultant Grant De Swardt told TechCrunch he noticed unexpected Claude Max 20x usage on August 4. After disabling connected work the next day, he saw usage rise from 45% to 55% in one interval. Anthropic suspended the account, invalidated sessions and server-side Claude Code credentials, and issued a partial refund.
According to his account of Anthropic’s investigation, a compromised Claude session key was used to mint unauthorized Claude Code OAuth credentials and handle activity for other people. Access credentials and the model-usage tokens being consumed are different things.
The original route of access remained unclear
The report also examines warnings Anthropic sent to other users about information-stealing malware taking login sessions. De Swardt said he found no evidence of infection on his own machine, leaving the original route of compromise unresolved.
His account was reinstated after about two weeks, but he did not receive itemized usage. The case shows why totals, task activity and login credentials need to be traceable to help users identify work they did not initiate.
Important additions and corrections
Dates below mark changes to our coverage.
- Addition ·
Added the usage interval, credential investigation and account restoration, distinguishing access from model usage.
Sources and notes
sources中文
Sources and notes
- Read the originalTechCrunch AI
Retained summary and context
Read claims in the context of the original page. Claims remain attributed to their sources. Collection is not proof of the claims or practical outcomes.
Sources and evidence · 2 links
Each link has a purpose and scope. Link counts do not establish independent confirmation; direct support applies only to the statements specified below.
This page keeps the original link and a short account. Follow the links below for the publisher’s full explanation.
Source timeline
- · Found this reading link via TechCrunch AI.
Collection record
First discovered: ; added to the library:
Collection and source publication have distinct dates.
Editorial record
Sources reviewed
· Beijing time (UTC+8)
Added the usage interval, credential investigation and account restoration, distinguishing access from model usage. Original event, discovery and collection dates remain.
Sources and full record
This dates our review of the wording and sources, not a project release or product update.
Full record: before, after and sources (JSON)