Hackers are stealing Claude tokens from subscribers

The incident shows tokens being consumed without user activity

According to TechCrunch, a Claude subscriber noticed last month that their account was consuming tokens even though they were not working, and Anthropic has warned users about hackers. This case demonstrates that leaked API keys can translate into direct costs and operational risk via unauthorized model use.

How to immediately secure API keys and limit loss

1. Rotate keys immediately: revoke compromised keys and issue new ones.
2. Store secrets in a vault: use a secrets manager rather than embedding keys in repositories or config files; OWASP recommends this as an API security baseline.
3. Restrict scope and privileges: grant tokens the minimum necessary privileges (least privilege) and fine-grained scopes.

How to monitor consumption and implement cost and privilege alerts

1. Introduce consumption metrics: log token counts per key, integration ID and call origin.
2. Configure thresholds and alerts: set alerts for daily/monthly consumption thresholds and real-time cost spikes.
3. Automatic throttling and blocking: on anomalous traffic spikes, automatically reduce privileges or suspend the key pending investigation.

Legal obligations in the EU for key leaks and unauthorized use

1. Breach notification: under Regulation (EU) 2016/679 (GDPR), supervisory authorities must be notified within 72 hours when a personal data breach occurs; consult the official text on EUR-Lex for details.
2. Documentation and customer communication: maintain an incident log, describe impact on personal data and disclose remediation measures as required.

Where risk typically lies in AI integrations and common pitfalls

Risk accumulates when keys are distributed across many services, environments are not separated, and privileges are broad. OWASP notes API attacks commonly exploit leaked secrets, missing rate limits and absent contextual monitoring. Integrations with third-party tools without privilege audits increase exposure.

Conclusion

Immediate steps: 1. rotate and store secrets in a vault, 2. implement consumption monitoring and cost thresholds, 3. enforce least-privilege policies and automatic blocking on anomalies. The TechCrunch report and Anthropic warnings underline that securing API keys and telemetry is a business-critical priority for organizations using models.

Lub System helps B2B companies implement AI, automation and IT solutions end-to-end - from strategy to deployment. See our services or get in touch to discuss your case.