Silent AI token theft drains accounts without user action
There is a specific kind of trust we place in tools that work invisibly. We do not check the plumbing behind the wall, nor do we audit the electrical current flowing to our lights. We assume the infrastructure is sound until the day the switch flips and nothing happens. For Grant de Swardt, an independent AI consultant in East Sussex, UK, that switch did not just flip — it was pulled out of the wall entirely. His story, detailed in a recent report by TechCrunch, exposes a vulnerability that sits not in the AI’s reasoning, but in the silent machinery of access and authentication that powers it. [1]
The Invisible Meter Running
On the morning of August 4, de Swardt noticed something that should have been impossible. He had not opened his Claude Max 20x account, had not queued a single task, and had not even touched his keyboard for work purposes. Yet the token counter on his dashboard was climbing with the steady determination of a metronome. By the next day, he had performed a controlled experiment: he disabled every integration, paused all scheduled tasks, and turned off cloud execution. The usage needle moved anyway, from 45% to 55% during a period of absolute inactivity.
The numbers themselves are not dramatic — a ten percent creep over a day. But for someone who lives by the precision of these systems, the implication was chilling. Token allowances are the currency of the AI economy; they are metered, billed, and rationed. When they disappear without a trace, it is not merely a billing discrepancy. It is evidence that something else is breathing inside your digital space. De Swardt contacted Anthropic immediately, asking for an itemized breakdown of what had consumed his allowance. The company could not provide one. They agreed that something was wrong, suspended his account, invalidated his sessions, and refunded him a partial sum of £44.49 for the unused portion of his $200 monthly subscription. [1] The report notes that Anthropic’s support team acknowledged the unauthorized activity but could not pinpoint the exact source of the breach
The Cost Beyond the Credit
The suspension was not an inconvenience. It was an amputation. De Swardt runs a solo practice where he helps small and mid-size businesses deploy AI agents for practical tasks — loading purchase-order data from emails into accounting software, managing daily admin, designing websites, writing code. He is what the industry calls a forward-deployed engineer, but without the safety net of a large firm behind him. His entire business operates through the very system that had just locked him out. Every client project, every automated workflow, every scheduled report ran on the assumption that Claude would be there in the morning. When it was not, the silence was deafening.
The investigation that followed revealed the culprit, but not the method. Anthropic told de Swardt that a compromised session key had been used to mint unauthorized OAuth tokens. The account, they said, appeared to have been accessed by an unauthorized third-party service handling activity for other people. The evidence was consistent with two scenarios: either credentials had been stolen without his knowledge, or the account had been connected to an outside service. They could not determine which. De Swardt insists he found no evidence of malware on his computer. He is left with a mystery that is more unsettling than a clear-cut hack: the possibility that access was gained through a vector no one can identify or explain.
The Malware That Walks Through Doors
De
Swardt is not alone, though he felt like it when he first posted his experience on Reddit. Within eighty comments, a pattern emerged. One user reported their account was auto-upgraded without consent, their credit card charged, and their usage shot from zero to one hundred percent without them touching the interface. Another watched their token consumption jump from zero to 49% in twelve minutes, having only used the service for a couple of prompts and a web search. A third burned through their maximum daily allowance for three consecutive days without any activity on their part, then filed a detailed report on GitHub.
The common thread was eventually identified by Anthropic itself, in emails sent to some affected users. The company had become aware of a bad actor using common infostealer malware to steal login sessions from people’s computers. Infostealers are a class of malicious software that installs itself quietly on a machine and harvests saved passwords, session data, and login credentials. They spread through infected downloads, malicious ads, and compromised websites. Once installed, they sit dormant, waiting for the user to log into their AI assistant, then they copy the session token and send it to a remote server.
The Blind Spot in the Dashboard
The deeper problem, as de Swardt discovered, is that the architecture of these systems is not designed for transparency. Account support tracks total usage but not itemized usage. Even upon explicit request, Anthropic could not tell him which specific sessions, tasks, or processes had consumed his tokens. This is the equivalent of a bank telling you your account balance is low but refusing to show you the transaction history. Without itemized logs, theft can go on for months, silently draining resources while the legitimate user wonders why their allowance seems to shrink faster than expected.
This opacity is not a technical limitation. It is a design choice. The systems that power modern AI assistants are built for convenience, for seamless integration, for the frictionless experience that makes them so appealing. Authentication tokens are meant to be invisible, to work in the background so the user never has to think about them. But invisibility cuts both ways. When the token is stolen, the theft is just as invisible as the legitimate use. There is no way to distinguish between your own background processes and an intruder’s parallel activities, because the system does not offer that level of granularity to the user.
The Trust That Was Broken
De Swardt’s account was reinstated after about two weeks. The refund was processed, the sessions were invalidated, and the immediate crisis passed. But the damage was not financial. It was existential. He cancelled his subscription and moved to Cursor, a platform that supports multiple models including more affordable open-source options. [2] In his assessment, the other models work just as well as Claude for his purposes. The difference is not in capability but in accountability. He says he cannot see himself returning to Anthropic without the company having actually resolved the issue in any meaningful way.
The broader implication is uncomfortable for anyone who has embraced AI as a productivity multiplier. We have outsourced not just tasks but trust to these systems. We let them read our emails, draft our contracts, manage our schedules, and process our data. We assume that the companies behind them are watching the gates. But the gates are guarded by tokens, and tokens can be copied. The security model relies on the assumption that the user’s device is clean, that the session data is private, that the connection between human and machine is sacred. When that assumption fails, there is no fallback, no alarm, no red flag waving in the dashboard.
The Lesson
Buried in the Logs
What de Swardt’s experience reveals is not a failure of AI itself, but a failure of the surrounding infrastructure to protect the value it creates. The gains are real — he built an entire business on them, and he still believes in the technology. But the gains are fragile when the foundation is opaque. He notes that Anthropic still lacks tools that allow users to see what is consuming their tokens. Without such visibility, he argues, there is no way for users to protect themselves. You cannot defend against a threat you cannot see.
The company declined to comment on how users can identify misuse, which is telling. In an industry that prides itself on transparency and user empowerment, the silence on this particular issue speaks volumes. The technology that can write essays, debug code, and analyze complex datasets cannot tell you who is using your account or when. That is not a technical problem. It is a priority problem.
The Path Forward Through the Fog
The solution is not to abandon AI assistants or to retreat to manual processes. That would be throwing out the productivity gains that make these tools valuable in the first place. The path forward is to demand the same transparency from AI providers that we expect from financial institutions. Itemized usage logs, real-time alerts for anomalous activity, and granular controls over session tokens are not luxuries. They are necessities for anyone who relies on these systems for their livelihood.
De Swardt’s story is a cautionary tale, but it is also a roadmap. He did everything right — he noticed the anomaly, isolated the variables, documented the behavior, and escalated the issue. The system failed him not at the detection stage but at the response stage. Anthropic acknowledged the problem, issued refunds, and invalidated compromised tokens. What they did not do was give him the tools to understand what happened or to prevent it from happening again. That gap between corporate response and user empowerment is where the real vulnerability lies.
The Next Step That Follows
For now, de Swardt has moved on. His business continues, running on different models through a different platform. He has learned to live with a degree of uncertainty that was not there before. The experience has made him more cautious, more vigilant, more aware of the invisible currents that flow beneath the surface of every AI interaction. He checks his usage more frequently now, watches for anomalies, and questions the numbers that appear on his dashboard.
The broader community of AI users would do well to adopt the same vigilance. The tools are powerful, the gains are genuine, and the potential is immense. But the infrastructure that supports them is still maturing, and maturity comes with growing pains. The next time you see your token usage climb without explanation, do not dismiss it as a glitch. Ask the question that de Swardt asked, and demand the answer that he never received. In the world of AI, the most important tool is not the model — it is the ability to see what the model is doing when you are not looking. For de Swardt, that lesson came at the cost of trust in a system he had built his livelihood upon. For others, it may come cheaper — if they are willing to look beneath the dashboard’s surface before the silence sets in.
Sources
1. Anthropic
2. Cursor