Anthropic warns Claude users of token theft as hackers target subscriber accounts
Claude subscribers are reporting unauthorized token usage, prompting Anthropic to issue security warnings amid a rise in account compromise attempts.
Anthropic is alerting Claude users to a wave of account compromises in which hackers are stealing subscription tokens and burning through them without the owners' knowledge. The warning follows a report last month from a Claude subscriber who noticed his account was consuming tokens while he wasn't actively using the service. Anthropic has since acknowledged the issue and is urging users to secure their accounts.
The theft appears to target users who pay for Claude's API access or Pro subscriptions, where tokens are metered and billed. In the reported case, the user saw unusual activity in his usage logs, including requests that he did not make. Such incidents can lead to unexpected charges and service disruptions, as the stolen tokens are used for the attacker's own queries, often to run automated tasks or resell access.
Security researchers note that token theft is not new to AI services, but it is becoming more common as the value of these credentials rises. Unlike credit card numbers, API tokens and session keys are often stored in configuration files or browser extensions, making them a target for phishing and malware. Anthropic's warning advises users to enable two-factor authentication, rotate API keys regularly, and monitor usage dashboards for anomalies.