Hackers are stealing Claude tokens from subscribers (techcrunch.com)

Hackers have been stealing tokens from Anthropic's Claude AI users by exploiting compromised session keys, leading to unexpected and unauthorized token consumption. Independent AI consultant Grant De Swardt noticed suspicious activity on his account, which was erroneously using tokens despite being inactive. After reporting the issue, Anthropic suspended his account and later confirmed that unauthorized OAuth tokens were minted, likely due to credential theft via infostealer malware. This incident has spurred concerns within the AI/ML community regarding account security and the tracking of token usage. The significance of this issue is underscored by the growing reliance on AI for business processes, as many users, like De Swardt, depend heavily on Claude for various tasks. With little visibility into individual token usage, many users may be unaware that their tokens are being siphoned off until significant damage occurs. This incident highlights the urgent need for improved monitoring tools from AI companies to help users identify and mitigate potential misuse, as well as raise awareness about security risks associated with session data and credentials. As a result of these experiences, some users, including De Swardt, are exploring alternative AI solutions that provide better security assurances.