Anthropic faces class action over Claude Max caps as reports detail token theft draining subscribers' accounts

The lawsuit, reported by The Verge, was brought by former Federal Trade Commission attorneys Monica Vaca and Kati Daffan on behalf of Claude subscribers. It centers on Anthropic's Max plan, which costs $100 per month for what is marketed as five times the usage of the $20 Pro plan, and $200 per month for 20 times. The complaint says the multipliers in Anthropic's marketing materials are hidden in fine print: they apply only to rolling five-hour "sessions" that are also governed by a weekly cap. A customer would need to click through multiple hyperlinks, including a separate Pro plan page, to understand what those limits actually mean, Vaca said. "People see that they are going to get this dramatically expanded usage," she told The Verge. "What we hear from people is that when they sign up, they are surprised that they're not getting the usage that they thought they were getting."

The complaint was initially filed in July, withdrawn, and resubmitted as an expanded class action on Tuesday. In an earlier motion to dismiss, Anthropic argued that the limits were not omitted because a consumer could click hyperlinks in the purchase process, which the company described as the digital equivalent of turning over a product to read the back label. Anthropic did not respond to The Verge's request for comment.

In a separate report published Tuesday, TechCrunch detailed a token-theft problem that has hit several Claude Max users. Grant de Swardt, an independent AI consultant in East Sussex, England, noticed on Aug. 4 that usage on his $200-per-month Max 20x account was climbing while he performed no work. In a controlled interval, his usage rose from 45% to 55% with no active tasks, scheduled jobs paused, and cloud execution disabled. Anthropic suspended the account, invalidated sessions and server-side tokens, and issued a partial refund of £44.49, but de Swardt said the company could not explain how the intruder obtained access. It told him a compromised Claude session key had been used to mint unauthorized Claude Code OAuth tokens, and that the evidence was consistent either with credentials being taken without his knowledge or with the account having been connected to an outside service.

Several other Claude subscribers told TechCrunch they found unexplained activity on their accounts. One Reddit user reported that their account was auto-upgraded without consent and usage shot from zero to 100%. Another saw usage jump from 0% to 49% in 12 minutes after only a few prompts and a web search. Two users shared emails from Anthropic in which the company said a "bad actor" was using common infostealer malware to steal login sessions and consume usage. Anthropic signed those users out, invalidated existing authorizations, and issued some refunds, but de Swardt said he did not receive such a warning and found no evidence his own computer was compromised.

Anthropic's account support tracks total usage rather than itemized usage, which TechCrunch said meant theft could go on for months unnoticed. de Swardt got his account back after about two weeks but cancelled the subscription and moved to Cursor, saying he could not see returning unless Anthropic gives users a way to see what is consuming their tokens. Asked how users can identify misuse, Anthropic declined to comment to TechCrunch.

Editor's Summary

The class action against Anthropic claims the "5x" and "20x" usage multipliers for Claude Max are not what they seem because of session and weekly limits, and the lawyers behind it previously worked at the FTC. TechCrunch reports that hackers have stolen Claude tokens from subscribers, with affected users saying Anthropic does not provide itemized usage to help detect such theft. The two stories show premium AI subscription plans coming under legal and security scrutiny.