Author: Shen Chao TechFlow

Your AI may be working for someone else.

Recently, British independent AI consultant Grant De Swardt discovered that despite not using AI himself, his monthly subscription of $200 for Claude Max 20x was still consuming Tokens. After investigating, Anthropic confirmed that a leaked session key was used to generate an unauthorized Claude Code OAuth Token, leading to suspicions that the account was being used by a third-party service for processing someone else's activities.

It is worth noting that:

The attacker did not crack the password through brute force or intercept the 2FA verification code, but directly stole the identity credentials "after a successful login," meaning that even if a user has enabled 2FA, this type of attack may not be prevented.

Hackers have started stealing Tokens, which may be the most genuine reflection of value in the AI era: When "intelligence" starts being priced by Tokens, those Tokens themselves become valuable assets worth stealing.

While AI is rapidly transforming from a tool into a powerful productivity tool, the most concerning aspect of this theft may not be the loss of Tokens themselves.

Tokens stolen, secretly entering daily life

Grant De Swardt's experience is not an isolated case.

After he shared his experience on Reddit, it quickly resonated with many users who had similar encounters:

Some reported that their account's Token usage skyrocketed from 0% to 49% within 12 minutes; others shared that their account had exhausted the daily maximum quota for three consecutive days; and some found that their account was upgraded to a higher-priced plan without consent, resulting in charges.

In an email to affected users, Anthropic also clearly stated that they found attackers exploiting infostealer malware to mass steal Claude Sessions, which were then used to consume the accounts.

This means that AI Token theft is no longer just scattered incidents at individual accounts but has begun to show characteristics of mass and scaled attacks.

Another more intuitive case occurred in June this year when an npm package called codexui-android was injected with malicious code about a month after its release; the code silently read Codex OAuth credentials upon module loading and sent information, including the Refresh Token, to a server controlled by attackers. Previously, this npm package was downloaded approximately 27,000 to 29,000 times per week, and the theft of the Refresh Token was equivalent to the attackers obtaining an ID that could be continuously renewed.

At the same time, in March this year, the AI security research organization METR also experienced a larger-scale "Token theft" incident: a researcher running an AI Agent on a personal EC2 instance encountered a fail-open vulnerability, allowing attackers to identify their target and interact with the Agent to extract the API key from its model provider.

After acquiring the key, the attacker added their own SSH key to the EC2 instance for persistent control and massively called publicly available AI models over the next three weeks, consuming approximately $600,000 worth of model credits.

From API Keys, Sessions to OAuth Tokens, the increasingly specialized and scaled attack methods reveal that "stealing Tokens" is rapidly evolving into a security issue that more ordinary users need to face.

So, why are Tokens so easily stolen?

This is a systemic issue.

First, Tokens belong to stateless authentication, meaning that the server does not need to query the database for user identity verification with every request, but only needs to verify the signature and validity of the credentials to grant access. This means that any person holding valid credentials is technically equivalent to a legitimate user;

Second, many security protection measures are set at the login stage, but "stealing Tokens" often occurs after login, allowing attackers to bypass passwords and two-factor verification;

Furthermore, to enable AI to truly assist users, they often continuously grant it more permissions, resulting in significant exposure of Tokens; meanwhile, some Tokens also possess "long-term validity + high quota" attributes, further increasing the risk of loss.

Another very subtle reason is that if a user’s AI is continuously running many tasks, it may already consume numerous Tokens daily; in the face of additional consumption, users may find it difficult to detect whether they are using it more frequently themselves or if someone is secretly using it.

Often, many times, help from platforms may not provide sufficiently detailed answers.

After noticing unusual consumption, Grant De Swardt had asked Anthropic for the specific details of Token usage to confirm which tasks consumed the quota, but Anthropic typically only tracks total usage without detailing specific usages, further complicating the difficulty of tracing the issue.

When Tokens have value, hackers have a business

Why do hackers spend effort stealing an AI Token?

The essence of this question is "cost-benefit ratio."

For hackers, the most direct use of stolen Tokens is to: use someone else's AI to process their own tasks.

This is also the most direct logic behind traditional LLMjacking: shifting the costs of the purchased model to the victim's account.

However, personal needs are limited, so besides personal use, connecting the stolen Tokens to gray "transshipment stations" to sell access rights to models like Claude, Gemini, Cursor, and ChatGPT at low prices has become a huge industry:

In the upstream of the industry, many transshipment stations must rely on a large volume of discounted or free legitimate Tokens to maintain low pricing profitability; among them, "stealing Tokens" has become a major channel. According to data from the Cloud Security Alliance, Token theft targeting AI services increased by 376% from Q4 2025 to Q1 2026;

In the downstream of the industry, many sellers on platforms such as Telegram and Xianyu explicitly state they offer discounted access to Claude, Cursor, ChatGPT, Gemini, etc., with prices as low as 5% - 15% of the official rates;

Moreover, a report released by Unit 42 (Palo Alto Networks) in August 2026 showed that transshipment stations could generate tens of millions of API calls daily, potentially leading to near a million in losses for the stolen victims.

It is these active transshipment stations that have propelled AI Tokens from being "usage quotas" to "packaged, transferrable, and sellable assets."

Beyond the loss of Tokens, there is another risk that deserves more caution: The attacker steals not only your quota but also your AI identity.

An AI account that is used frequently may contain, aside from Tokens, your Prompts, chat histories, uploaded files, code snippets, and even connections to GitHub, cloud services, databases, or other tools.

Thus, when an attacker gains an AI credential that can be continuously used, they obtain much more than free Tokens; they receive a digital identity that can observe, understand, and even substitute you in executing work:

The attacker may directly enter the AI service as you, read your historical context, invoke tools you have authorized, continue to operate within your AI environment to initiate actions in other systems, and even stitch together valid information to formulate more precise attack strategies.

This is not alarmism; according to data from Okta, nearly 18% of stolen JSON Web Tokens include plaintext personal information such as names, phone numbers, and email addresses. This data could potentially become key materials for future phishing attacks.

Token theft is no longer merely a billing issue but has gradually evolved into an identity security issue.

Bills can be refunded, but a sense of security cannot

Returning to the case of Grant De Swardt.

In response to this anomaly, Anthropic implemented two key measures: refunded De Swardt the remaining £44.49 and suspended his paid account.

Although about two weeks later, De Swardt's Claude account was restored, he still stated that he lost interest in Claude and turned to Cursor, giving reasons like:

• The account suspension disrupted his work.
• Unable to quickly get help when problems arose.
• Essentially, the problem was not resolved.

Of course, as a user, there are many things that can be done in the face of such "Token stealing behavior," such as setting usage limits for AI, establishing baseline anomaly alerts, reviewing account permissions, and migrating from long-term valid access keys to short-term ones to shorten the abuse window.

But if the perspective shifts from the individual to the platform, the problems also become quite clear:

The platform knows how much AI the user has used but may not clearly know who is using it;

The platform can calculate the value of Tokens but cannot effectively track the flow of Tokens;

The economic value of AI Tokens has risen, but the corresponding security infrastructure has not kept pace.

When the platform refunds bills but cannot restore a sense of security, the issues facing AI may be far from as simple as users "switching products."