Your Claude Usage Drains While You Sleep, and Anthropic Named the Infostealer

If your usage limit dropped during hours you never opened Claude, your own machine may be the reason. On August 30, 2026, Anthropic started sending exactly that notice to a subset of users. Commodity credential-stealing malware, what the security industry calls an infostealer, running on the user's own PC copied their Claude login session, and an attacker then walked in with that session and burned through the victim's paid usage.

Anthropic says it force-logged-out the compromised sessions, deleted saved payment methods as a precaution, and refunded charges confirmed as unauthorized. It has not disclosed how many accounts were affected.

The theft was a login cookie, not a password

What was stolen defines the shape of this incident. Once you log in successfully, a website hands your browser a token that says "this person has already been verified." That is the session cookie, and from then on presenting it is enough. No password prompt, no second factor. An infostealer does not crack the password. It copies that already-issued token wholesale.

So the attacker never logs in. They simply replay the stolen token. A long password does nothing here, and neither does two-factor auth or SSO, because the attack does not pass through the authentication steps. It takes the artifact those steps produce.

Anthropic described the malware this way in its notice: general-purpose malware that usually arrives with unofficial downloads or malicious apps and quietly copies passwords and login cookies stored in the browser, along with credentials from other locally running apps. The same notice closed off a likely misreading up front, stating that there is no indication the malware is related to Claude, was installed through Claude, or is connected to anything done with Claude.

The named families are commercial kits that have been circulating for years: Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer (AMOS) on macOS, with macOS infections making up a small share. One victim traced their own infection to downloading a pirated game from a Russian-language underground forum.

Anthropic wrote the detection criterion itself: if your usage limit appeared to refill and then decrease while you were not using Claude, this is likely the cause. Which is also to say there is no visible signal like a locked account or vanished conversations.

Why burn usage instead of reading conversations

There is a market behind the choice to spend usage rather than read chat logs. Resale of stolen AI subscriptions and API access grew into a real underground trade through 2025, and the security industry calls it LLMjacking. A Cloud Security Alliance research note documented marketplaces selling access to more than 30 providers at 40% to 60% below list price, distributed through Telegram and Discord, and observed 35,000 attack sessions targeting AI provider accounts between December 2025 and January 2026.

A stolen session is inventory. When an account sells, the buyer spends the tokens and the bill lands on the original owner. That is why Anthropic deleted saved payment methods rather than only killing sessions: it cut the path where hitting the usage cap automatically rolls into additional charges.

Anthropic's actions are account-side first aid, and the notice says so plainly. Logging out severs the stolen session but does not remove the malware; if it remains on the computer, the next login session can be taken the same way. The recovery order Anthropic gave is: scan for and remove the malware first, then change the email account password and enable two-factor auth, then rotate passwords saved in the browser and check card statements, and only at the end re-add a payment method to Claude. Re-adding the card before cleaning the infected machine puts you back where you started.

Terminating every web session leaves Claude Code tokens behind

This section applies only to developers using Claude Code. If you never touch the browser and only run Claude from a terminal, it is fair to wonder whether "log out" above applies to you at all. The answer is half.

claude.ai web sessions live under Settings > Account > Active sessions. Each entry shows the browser and operating system, an IP-based location estimate, and last-used time, and the three-dot menu has a Terminate action that remotely signs that device out. This screen exists only on the web, not in the iOS or Android apps.

Claude Code authentication tokens are not in that list. Anthropic's support documentation says to delete Claude Code tokens separately under Settings > Claude Code using the trash icon. Because the screens are split, clicking "log out of all sessions" is not evidence that the CLI side was cleaned up too.

Where those credentials sit depends on the operating system. Per Claude Code's official documentation, macOS stores them in the encrypted Keychain and Linux in ~/.claude/.credentials.json with mode 0600. On macOS, a rejected Keychain write falls back to that same file.

Keychain storage on macOS is less solid than it sounds. On July 28, 2026, the security firm Silverfort published a finding that when the Claude Code CLI creates its Keychain entry through security add-generic-password, the resulting access control list trusts only the /usr/bin/security binary. That binary can be invoked by any process running as the user. One line reads out the access token, the refresh token, and credentials for connected MCP servers with no password prompt, no biometric check, and no notification.

security find-generic-password -s "Claude Code-credentials" -a "$USER" -w

While writing this, I confirmed up to the point that the entry does exist on macOS and is queryable without a prompt, running the command without -w. Anthropic acknowledged the report on July 24, 2026 and said it was tracking stronger access control on the Keychain entry as a hardening improvement, but did not classify it as a vulnerability under its threat model. It was unpatched as of Silverfort's disclosure. The current notification wave includes macOS infections, and Atomic Stealer is a family that targets the Keychain specifically. Attacks that steal coding agent authentication tokens already showed up once in a June 2026 npm package incident.

One distinction is worth keeping clear. GitHub issue #43801 contains a reproduction where OAuth tokens cached on the client kept working after both "log out of all sessions" and "revoke all Claude Code instances" were clicked. It carries the area:auth and area:security labels and was closed without a public maintainer response. That is a user report, not something Anthropic confirmed. It does support not assuming that a revoke button on the web cleaned up the CLI, and running claude logout on the device itself if you suspect infection. Teams tuning internal detection rules can add the token string prefixes sk-ant-oat and sk-ant-ort to leak detection patterns.

The screens to open today

Session cleanup and token deletion carry no plan or region conditions.

The first move is comparison, not cleanup. Open your claude.ai usage screen and look for stretches where the limit dropped during hours you were not running Claude. If you find one, terminate sessions from unfamiliar devices under Settings > Account, delete unused authentication tokens under the separate Settings > Claude Code list, then clean the suspected machine before re-adding a payment method. Reverse that order and any malware still resident hands out a fresh session immediately.