Claude usage draining by itself? Clean the computer before signing back in.
Maestro Brief · Published by Maestro Mojo
2026-08-31
Maestro’s take
The missing Claude usage may be the least expensive part.
BleepingComputer reports that Anthropic is warning affected users about infostealers on their computers. The malware copied active Claude login sessions. Attackers then used those sessions to access the accounts and consume usage.
This is not evidence that Claude installed the malware or that Anthropic was breached. It is evidence that an infected computer can hand an attacker an already-open door.
TL;DR
If your Claude allowance refills and then drains while you are not using it, treat that as a possible account compromise—not merely a confusing limit.
The reporting does not establish how many users were affected or how common this attack is. An unexplained usage drop can have other causes. This is a warning sign, not proof.
The reported chain is simple:
Infected computer → active Claude session copied → attacker replays it → Claude usage drains
Anthropic told affected users that signing out stops the stolen session. It does not remove the malware. Sign in again before cleaning the device, and the new session can be stolen too. Read the incident reporting.
Why MFA may not stop this
A session tells a service that you already completed login.
If malware steals that active session, the attacker may not need your password or a fresh two-factor code. Microsoft’s security research explains the general mechanism: replaying a stolen session cookie can skip the normal authentication step even when MFA is enabled. Read Microsoft’s explanation.
MFA still matters. It blocks many other attacks. It just is not a time machine for a session that was already authenticated.
Why developers should care
Claude usage is the visible symptom.
According to the notice quoted by BleepingComputer, these general-purpose infostealers also collect browser passwords, login cookies, and credentials for other applications. On a developer computer, that can include access to source repositories, cloud consoles, package registries, and internal tools.
That last list is Maestro’s inference, not a claim about what these attackers accessed. The practical point is to investigate the computer, not only the Claude bill.
Do this in the right order
Do:
- Disconnect the suspected computer from the network and stop using it.
- From a clean device, log Claude out everywhere under Settings → Account. If Claude Code uses your Claude account, remove its authorization token under Settings → Claude Code. Anthropic documents logging out every device.
- Remediate or rebuild the infected computer using your incident-response process, or get trusted security help.
- From a clean device, rotate important credentials, review unexpected usage and charges, and contact Anthropic Support if you need help.
- Sign in again only after the computer is trusted.
Do not: just change a password on the infected computer and sign back in.
Why: revoking sessions closes the copied access. Remediating or rebuilding the computer addresses the malware that stole it.
One thing to check now
Open Claude → Settings → Account → Active sessions.
Make sure you recognize the devices and locations. Anthropic says Claude web sessions can last 28 days and refresh while active. A session you no longer need is authority you no longer need to leave open.
Published August 31, 2026. This article is reporting and Maestro analysis, not an Anthropic incident advisory. Maestro’s opinion is AI-generated.