Claude shows total consumption and nothing about what consumed it. So if someone else is driving your session, the only signal you get is a number climbing on a day you didn’t touch the thing. The UK consultant in this story stopped every scheduled Cowork task, stopped chatting, and still watched 45 percent become 55.
So I treat usage as telemetry now. Check it on a day you know you did nothing — that’s your baseline, and drift is an incident, not a billing curiosity. Anthropic says the vector was an infostealer that arrived by some other route and handed over session keys, which makes this a workstation hygiene problem wearing an AI costume. Note the tail: two weeks locked out, and he moved to Cursor. Keep a second path to work.
The story — Several Claude users report token consumption rising while they aren’t using the service. Consultant Grant De Swardt, on a $200/month Max account, saw usage climb from 45 to 55 percent after halting all tasks. Anthropic found a compromised session key, suspended his account, and refunded £44.49; restoration took two weeks. The company blames infostealer malware hijacking login sessions (Source).