Is Your AI Subscription Being Drained? How to Check

Disclosure: Some links on this page are affiliate links. If you purchase through them, we may earn a commission at no extra cost to you. Full affiliate disclosure.

On August 4, an independent AI consultant in East Sussex, UK, watched his Claude Max 20x usage climb on a day he had not worked.

He ran a controlled test. The next day he disabled everything attached to Claude, paused scheduled tasks, switched off cloud execution, and confirmed no local Claude Code job was running. Usage went from 45% to 55% while he did nothing at all.

He asked Anthropic for an itemised breakdown and never got one. It did agree something was wrong: it suspended his paid account, invalidated every session and server-side Claude Code token, and refunded £44.49 for the unused remainder of a $200-per-month subscription. The cause, per Anthropic, was a compromised Claude session key used to mint unauthorised Claude Code OAuth tokens. The account "appeared to have been used by an unauthorized-looking third-party service to handle activity for other people, but they could not determine how it obtained access."

The coverage has mostly treated this as a Claude story. It is not. It is a story about a category of asset nobody thinks to protect, and about a security instinct that is flatly wrong.

Editor's Take

The practical advice here is worth acting on: unused API keys and stale subscriptions are a genuine drain and a genuine security hole. Audit what is connected, revoke anything unused, and check billing for services nobody remembers authorising. It takes twenty minutes and occasionally saves real money.

Two Things the Coverage Did Not Say

Changing your password does not help. This is the part worth stopping on. Almost everyone's instinct after "someone is in my account" is to reset the password. In this attack that is close to useless, because the thing the attacker holds is not your password. It is a session token — and active sessions and API keys survive a password reset unless you revoke them by hand. In some reported cases attackers went further and created hidden API keys under the victim's account, so the access persisted no matter how many times the password changed. If you change the password first and stop there, you have changed the lock while someone is still holding a working key.

Your AI subscription is now a stealable, resellable asset. A free AI account is worth nothing to a criminal. A paid Pro, Max or Team account is worth real money, because it is priority access to a frontier model that someone else is paying for. That access gets resold on Telegram and dark web forums as cheap unlimited Claude. The buyer runs the same workload they would otherwise pay API rates for, and you absorb it. Developers accessing Claude through the API have reported unexpected five-figure token spikes and surprise bills from exactly this.

How the Access Actually Gets Taken

Anthropic says its own systems were not breached, and there is no evidence its databases were compromised. This is account takeover via endpoint compromise. The malware lands on your machine.

The delivery is boring. Info-stealer families like LummaC2, RedLine and RisePro ride along with cracked software, fake Claude desktop apps and free AI tools. Once installed they scrape browser cookies, local storage, and saved session tokens for claude.ai and console.anthropic.com.

Here is the part that breaks people's mental model: with a stolen session token, the attacker needs neither your password nor your second factor. They inject your cookie into their own browser and they are you — logged in, on your subscription tier, with your stored credits. Two-factor authentication protects the front door. They came in through the window you left open last Tuesday.

There is a second path that is harder to spot. Malicious browser extensions — fake ad blockers, PDF helpers, tools marketed as "Claude productivity" add-ons — request permission to read data on all sites, then quietly exfiltrate Anthropic session keys and API keys. If you have ever clicked "allow" on an extension permission prompt without reading it, this is the risk you accepted.

What the Drain Looks Like From the Inside

Once they are in, the pattern is consistent across reports:

• API calls clustered between 2 a.m. and 5 a.m.
• Massive context-window prompts that burn quota fast
• Conversations you did not start, often in languages you do not use
• Content aimed at spam generation, SEO farms, phishing drafts, coding tasks and crypto scam chatbots
• Hidden API keys created under your account so the access outlives any password change

He posted the experience on Reddit and found he was not alone. One user said their account was auto-upgraded without consent, the card was charged, and usage ran from 0% to 100% untouched. Another watched it go from 0 to 49% in twelve minutes after a couple of prompts and a web search. A third burned through the daily limit three days running without opening the tool and filed a GitHub issue, where more people arrived with the same story.

The Part That Should Actually Make You Angry

You cannot see it. TechCrunch reported that Anthropic's account support tracks total usage but cannot produce itemised records, even when a paying customer explicitly asks. That is the most important structural fact here: he could prove something was wrong only by running his own experiment, and he still never learned what had been done with his quota.

So this can run for months. You get a percentage — no time, no session, no token count. Compare that to a bank statement, where every line has a merchant and a timestamp, and you can see how far the tooling has to go.

He got the account back after roughly two weeks and cancelled anyway, moving to Cursor for its multi-model support. The stated reasons were the pace of the response and the missing itemisation. Asked how users could identify misuse, Anthropic declined to comment.

The Check: Is Someone In Your Account?

None of this requires tools you do not have. Run it today.

1. Do the idle test. Pick a window — an afternoon, a full day — and do not touch the account. Pause scheduled tasks, disable cloud execution, make sure no local agent job is running. Write down the usage percentage at the start and the end. If it moves, something is using your quota that is not you.
2. Review your active sessions in account settings. Anthropic's own advice is to log out of all devices, which tells you a session list exists and that you can end them individually. Do not rely on it alone — a stolen session can look exactly like yours, which is why the usage test above carries more weight than the device list.
3. Open the API keys page and read every key. Developers especially. A key you do not remember creating is the persistence mechanism. Look at creation dates you cannot account for.
4. Check the billing side, not just usage. Unexpected plan changes, charges you did not authorise, or an auto-upgrade you did not request are all in the reports.
5. If you use the API, watch for overnight spend. Five-figure token spikes showed up on invoices before anyone noticed. Set a monthly spend limit and per-key caps before you need them.

If any of that comes back positive, the order of your response matters more than the speed of it.

Do It in This Order

Sequence is the whole game here, because the wrong order feeds fresh credentials straight back into a compromised machine.

1. Treat the device as infected until proven otherwise. If you suspect malware, do the next steps from a different, clean device. Log in from the infected machine after revoking and you hand over a brand new session.
2. Log out of all devices. In Claude settings, this invalidates existing sessions and kills the stolen cookies. Do this before touching the password.
3. Revoke Claude Code authorisations — the server-side tokens, managed separately from the web-side logout. This is the specific vector Anthropic identified.
4. Delete every unrecognised API key in the Anthropic Console and rotate the ones you actually use. Deleting is not optional; assume any key on an infected endpoint is public now.
5. Now change the password, and turn on two-factor authentication with a passkey or an authenticator app — not SMS.
6. Go wider than Claude. This malware scrapes browser cookies and local storage rather than one service's data, so anything else you stay signed into on that machine is in the same haul. Treat the Claude anomaly as the warning that surfaced, not the whole incident.
7. Then ask for the refund and the logs anyway. You may not get itemisation — Anthropic did not provide it here. Asking creates a record, and it did issue a partial refund for the unused subscription time.

Staying Out of This

Anthropic's own guidance is short and worth following exactly. Use a passkey or authenticator app for 2FA rather than SMS. Log out of all devices periodically, not just after an incident. Developers: delete keys you do not recognise, rotate the ones you use, and set strict monthly spend limits plus per-key caps. Never paste an API key into a browser extension, a public demo, a GitHub repo or a shared prompt — server-side environment variables only.

The rest is unglamorous. Do not install cracked software on a machine you log into Claude from. Do not download a "Claude desktop app" from anywhere but the official source. Be stingy with extension permissions, and be honest with yourself about the free AI tool you installed last month from a link in a comment.

For anyone running agents on a schedule, our guide to building an AI creator workflow covers where automation sits in a working setup, and the code assistant comparison is the place to check what you are actually connecting to your account. Freelancers billing clients for AI-assisted work should read the automation guide for freelancers — an unauthorised drain on a shared account is a client conversation you do not want to have.

The Honest Read

Anthropic was not breached. Its subscribers' laptops were, and the thing that got taken was not a password — it was a session, and behind it a quota that has a resale value nobody expected it to have two years ago.

Two habits cover most of the risk. Check your usage against your actual work often enough to notice when the two diverge, and learn the revoke-before-you-reset order. The password instinct is wrong here, and it is wrong in a way that costs you the exact window in which you could have stopped it.