It's not a platform vulnerability. It's the same credential theft that's drained API accounts since cloud platforms started handing out keys.
Everyone’s reading yesterday’s TechCrunch story as “hackers found a way into Claude.” They didn’t. What they found was the same door that’s been propped open on every cloud platform since AWS started handing out access keys: a long-lived credential, sitting somewhere it shouldn’t, doing exactly what it was designed to do for whoever happens to be holding it.
The alarmist reading isn’t stupid, to be fair. A paying subscriber woke up to token consumption they didn’t authorize, Anthropic issued a warning to its customer base, and the money was real. That is genuinely worth your attention. If your read is “I should go check my account right now,” you’re correct. If your read is “Claude has a vulnerability,” you’ve been handed the wrong villain.
The credential, not the platform
Here’s the distinction that matters at 2 a.m. when the billing alert finally fires. Two different things get called “tokens” in this story, and only one of them pays the bill. There are session tokens — the browser cookies that keep you logged into claude.ai — and there are API keys, the sk-ant- strings (the prefix Anthropic documents for its keys) that authenticate programmatic calls and rack up metered usage. Session hijacking gets someone into your chat history. An API key gets someone a machine that turns your money into their inference, silently, at scale, for as long as the key lives. Guess which one the attackers want.
How do they get it? The unglamorous ways. Credential stuffing against reused passwords. Phishing pages that harvest logins and 2FA prompts in real time. And the classic: keys committed to a public GitHub repo, pasted into a Discord, left in a client-side bundle, or logged in plaintext by some helpful middleware. None of that is a Claude weakness. It’s yours. That’s the part the “platform hack” framing lets you off the hook for, and the part that’ll bite you again in six months if you don’t fix the habit.
Go audit yourself now
In the Claude Console, open Usage and Cost and look at the shape of the curve, not the total. Steady daytime traffic with a flat overnight floor is you. A block of consumption at 3 a.m. from a model you don’t use, or a spend spike on a key you’d forgotten existed, is not you. Check the key list under Settings and note the last-used timestamps.
If you’re on an org plan, don’t trust the dashboard’s rounding — pull the numbers yourself. Anthropic’s Admin API exposes per-key, per-day usage and cost reporting; the endpoints have shifted before, so treat this as illustrative and confirm the current path in Anthropic’s Admin API docs before you wire it into anything:
The principle holds regardless of the exact route: pull per-key, per-day buckets and diff them against what you actually shipped. A key you can’t account for is a key you rotate today. The rest is the sensible, boring hygiene that predates this incident by years — rotate any exposed key immediately, turn on spend limits, scope keys to workspaces instead of running one god-key for everything, and enforce 2FA. None of it is novel. That’s rather the point.
Which is the real story. Pro subscribers who never touched the API are mostly exposed to account takeover, not runaway billing — annoying, not expensive. The people getting drained are the ones with active keys and no per-key alerts. OpenAI users lived a version of this over the past year: it’s been widely reported that keys harvested from public repositories led to unexpected bills before anyone noticed, which pushed usage caps and key-level tracking up the priority list. Anthropic is now walking the same road, one warning email at a time.
So no, nobody picked Claude’s lock. They walked in with a key you left in the door. Set a spend limit tonight, scope your keys, and stop treating sk-ant- strings like they’re less dangerous than your root password. They aren’t.
