Hackers Are Stealing Claude AI Tokens From Subscribers
- ai-news
- cybersecurity
- anthropic
Hackers Are Hijacking Claude Accounts to Steal Tokens
In early August, UK-based independent AI consultant Grant De Swardt noticed his Claude Max subscription (a $200/month plan) was rapidly burning through tokens — while he wasn't working. Even after disconnecting everything linked to his account, usage kept climbing. According to TechCrunch, after he complained to Anthropic, the company found that a compromised session key had been used to mint unauthorized Claude Code OAuth tokens.
He wasn't alone. On Reddit and in a GitHub issue, other users shared similar experiences — accounts jumping from 0% to 100% usage within minutes with zero activity from the owner. Anthropic confirmed that a bad actor is using common infostealer malware to steal saved login credentials from users' computers, then using those sessions to access Claude accounts and consume their usage. In identified cases, the company locked accounts, invalidated active sessions, and warned affected users.
The core problem: Anthropic's usage dashboard only shows total consumption, not an itemized breakdown — meaning this kind of theft could go undetected for months. For small businesses running AI agents for daily operations (like De Swardt, who relies on AI to run his entire practice), the incident is a real-world reminder: keep antivirus software updated, avoid downloading untrusted software or browser extensions, and monitor AI accounts — personal and business — for unusual usage spikes.
Meta Launches Muse, a Personal AI Agent — A Major Trust Test
Less than two weeks after agreeing to an $18 billion multistate settlement over social media harms to children, Meta unveiled Muse, a new personal AI agent designed to handle everyday tasks: sending emails, booking travel, filling out forms, and even making purchases via Stripe. To work, Muse requires deep access to a user's email, calendar, payment methods, and other everyday apps — a far greater level of access than any previous Meta product.
The company says the agent runs in an isolated, secured virtual machine and has no visibility into passwords or ad targeting data. Still, given Meta's long history of privacy violations — from Cambridge Analytica to billion-dollar FTC settlements — it remains to be seen whether consumers are ready to extend that level of trust.
Chrome Moves to Biweekly Updates as AI Reshapes the Security Landscape
Google has officially switched Chrome to a two-week release cycle (starting with version 153), down from four weeks. The company says the change is tied directly to the AI-era security landscape: automated AI-driven tools are finding vulnerabilities faster, and new threats — some themselves AI-driven — demand a shorter gap between discovering a fix and delivering it to users. Mozilla, Microsoft Edge, and Brave have already adopted similar faster release schedules.
For consumers and small business owners, the practical takeaway is simple: make sure auto-updates are enabled — the faster release cadence makes staying current more important than ever.
Report: Pentagon Asked OpenAI for Military AI With a 'Low Refusal Rate'
According to a report by The Intercept (cited by The Verge), the U.S. Department of Defense requested a custom version of OpenAI's technology with "minimal refusal rates" for military commands. OpenAI denied ever signing a contract with such phrasing. This claim rests on a single journalistic source that the company itself disputes, so it should be read with appropriate caution — but it adds to the broader ongoing debate over the boundaries of military use for commercial AI tools.