Hackers stealing Claude tokens, Anthropic investigates

On August 4, consultant Grant De Swardt found token usage climbing on his Claude Max 20x account despite inactivity. Anthropic suspended his paid account, invalidated sessions and server-side Claude Code tokens, refunded £44.49 for remaining subscription time, and said a compromised session key was used to mint unauthorized OAuth tokens.

• Anthropic Tests Claude Money Banking Feature2026-09-17
• Anthropic: adversaries used AI to target US naval forces2026-09-16
• Anthropic merges Claude chat and Cowork UI2026-09-16
• A warning about 'model welfare'2026-09-16
• Are Chinese firms handing US data to US firms?2026-09-15