Hackers are stealing Claude tokens from subscribers

Last updated: September 9, 2026

Hackers Are Stealing Claude Tokens From Subscribers

Massachusetts hits data centers with new clean power rules OpenAI loses a top data center exec as stream…

**Lede**

Last month, a Claude user noticed his account was consuming tokens even though he wasn’t working. Anthropic has since warned users about hackers. The incident sheds light on a growing security vulnerability in the AI subscription economy, where stolen access keys are being used to generate content and run queries at the expense of paying customers.

**Background**

Anthropic, the AI startup behind the Claude large language model, disclosed the breach after multiple subscribers reported unexpected token usage. According to the company, unauthorized parties gained access to user API keys or session tokens, allowing them to make requests through the Claude API without the account owner’s knowledge. The breach does not appear to stem from a flaw in Claude’s core model, but rather from compromised credentials—likely obtained through phishing, malware, or reused passwords from other data breaches. Anthropic has since urged users to rotate their API keys and enabled additional monitoring tools to detect anomalous activity.

**Why It Matters**

This incident matters for businesses and AI adopters for several reasons. First, it highlights that AI platforms are now prime targets for credential theft, just as financial services or email providers have been for years. Second, the financial impact can be significant; token consumption directly correlates with cost, and unauthorized use can inflate monthly bills unexpectedly. Third, it underscores the shared responsibility model of AI security: while providers must protect their infrastructure, users must also practice good credential hygiene. For organizations integrating Claude into workflows, the breach serves as a reminder to audit API key access, implement least-privilege permissions, and monitor usage logs regularly.

**What’s Next**

Anthropic has stated it is investigating the scope of the theft and working to improve token-level attribution so users can identify which requests were legitimate. The company is also likely to roll out enhanced authentication options, such as device-bound keys or temporary session tokens, in the coming months. For the broader AI industry, this breach may accelerate the adoption of standardized security practices, including token expiration, usage alerts, and tighter integration with identity management systems. Subscribers should expect more frequent security notifications and possibly new controls for managing API access.

Takeaway for Business Owners

If your organization uses Claude or any AI API, treat API keys like passwords: rotate them regularly, never hard-code them in public repositories, and monitor usage for sudden spikes. A compromised key can quickly turn into unexpected costs and potential data exposure. Now is a good time to review who has access to your AI credentials and ensure that only authorized personnel can generate requests on your behalf.

Source: Original Article

Related: Nscale adds former OpenAI exec Fidji Simo to its board ahead of potential IPO, Jensen Huang explains why Nvidia will grow an astounding 70% next year, AI agents are flooding public services with new requests.

For more on this, see Another swarm of OpenAI agents reached the open internet without the frontier lab’s knowledge.

Share this article