EVENT DOSSIER
On September 8, 2026, several Claude users noticed that their account quotas were quickly consumed without any apparent action. British consultant Grant Deswart encountered this issue on August 4, and his account’s usage continued to rise even when there were no local tasks. Anthropic confirmed that hackers used stolen login sessions to exploit the quotas. The attackers obtained session keys through information theft malware and generated OAuth tokens, consuming quotas or automatically upgrading subscriptions without the users’ knowledge. Since Anthropic’s customer service system could only view total usage without detailed records, the theft may have gone undetected for several months. Due to slow processing and lack of detailed recording tools, Deswart ultimately canceled his subscription and switched to Cursor. Anthropic has suspended the relevant accounts, cancelled the tokens, and refunded the fees.
9 月 9 日，多名 Claude 用户在未操作情况下发现账号额度被快速消耗，Anthropic 确认系黑客利用窃取的登录会话盗用额度。英国顾问格兰特·德斯沃特于 8 月 4 日遭遇此问题，其账号用量在无本地任务时持续上升，最终 Anthropic 承认异常并暂停账户、注销令牌及退还 44.49 英镑费用。调查指出，攻击者通过信息窃取恶意软件获取会话密钥生成 OAuth 令牌，在用户不知情下消耗额度或自动升级订阅。Anthropic 客服系统仅能查看总用量无法提供明细，导致盗用可能持续数月未被发现。德斯沃特因处理缓慢且缺乏详细记录工具最终取消订阅转用 Cursor，并指出 Anthropic 目前缺少帮助用户识别额度消耗来源的工具。