Breaking

Anthropic Warns Claude Users About Account Takeovers After Token-Usage Incident

September 8, 2026 at 17:16 EDT

Security
AI Agents
Sales & Business

Anthropic is warning Claude users that suspicious activity can expose accounts and consume usage, after a user noticed tokens being used while no work was underway. The episode highlights a broader security problem for AI services: an account compromise can drain usage limits, expose conversation data, or allow unauthorized activity even when the legitimate user is not actively interacting with the product.

Security alert · Claude accounts

Unexpected usage can be a warning sign

Unauthorized sessions and browser-based agents can consume usage or expose data. Anthropic says defenses reduce risk, but do not eliminate it.

AI platforms covered in the account-security guide

Paid plan types with Claude in Chrome availability

<0.08%

Internal prompt-injection attack success rate

Internal test result, shown proportionally

100%

Unmitigated baseline

<0.08%

Current configuration

Anthropic reports a large reduction in its internal combined-technique test; real-world risk remains non-zero.

Protective actions

Review active sessions, terminate unfamiliar access, use a separate browser profile, and manually approve sensitive actions.

Remaining exposure

Claude can see visible browser content, and novel prompt injections may evade defenses.

The control loop

Unexpected usage → Review sessions → Revoke access → Set spending limits

Usage credits can continue after plan limits and are billed separately, so account controls and spending controls should be checked together.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.