AI News · Edition 37 ·
Your AI Account Is Now Worth Stealing
Stolen Claude subscriptions, a heavy Microsoft patch cycle, and a maths claim under fire — plus what a sensible owner should actually do about any of it.
The one that matters
Hackers are stealing Claude subscriptions — and your account holds more than you think
TechCrunch, followed by a second outlet, reports that criminals are stealing Claude access tokens from paying subscribers. A token is simply the string of characters that proves to the provider's servers that a request is coming from your paid account. Whoever holds it can spend your allowance without your password and without your knowledge. The published detail is thin, so treat the exact mechanism as unconfirmed — but the direction is clear enough to act on today.
What this actually means for your business
Two things, and the money is the smaller one. A paid seat runs roughly ₹1,700–2,000 or about C$30 a month, so a stolen seat is an irritation. A stolen API key on a usage-based account is different: it bills by volume, and someone reselling access can run up a bill for weeks before your card statement arrives.
The bigger problem is what is sitting inside the account. Since your staff started using AI, that login has quietly become the least-protected copy of your most sensitive documents. At a 600-student school, the office manager pasted the fee-defaulter list in to draft reminder letters. At a 30-bed clinic, the front desk pasted a discharge summary in to simplify the language for a patient. At a twelve-person agency, someone pasted a client contract in to summarise it. None of that went through your ERP or your accountant. It is in a chat history behind one password that one person chose, and possibly reused.
What it does not mean, and who will oversell it
Nothing in the reporting says the provider itself was broken into. Credentials of this kind usually leak from the customer side — a personal laptop carrying information-stealing malware, a key pasted into a WhatsApp group, an unofficial browser extension promising cheap or free access. It also does not mean AI tools are unsafe to use in a business; a stolen password for your accounting software would be worse.
Expect the overselling within a fortnight. Someone will pitch your 40-person workshop an AI security platform on a monthly subscription, citing this exact story. You do not need one. The controls that would have prevented this cost nothing and take an afternoon.
What to do this month
- List every AI account the business pays for, including the ones staff bought on personal cards and expensed. This list is almost always longer than the owner expects.
- Turn on two-factor authentication on each, and move them onto company email addresses rather than personal Gmail accounts. Thirty minutes.
- Rotate every API key older than three months, and any key that has ever appeared in a chat, an email or a shared drive. Treat those as already public.
- Set a hard monthly spend cap on any usage-based account. It converts a runaway bill into a small one.
- Open the billing page and read last month's usage. Volume you cannot account for, or activity at odd hours, is the tell.
- Give staff one rule in one sentence: nothing goes into a chat window that you would not hand to a stranger at the gate. If the work genuinely needs patient names, salary data or signed contracts, pay for the business tier and switch off training on your data.
That is the whole response. No new vendor, no new line item — just the same account hygiene you already apply to your bank login, applied to the tool your staff now paste everything into.
Also worth knowing
How this briefing is put together
Every morning we read the day’s AI announcements and reporting from the companies themselves and from the technology press, then pick the handful that actually change something for a working business. The analysis is ours and it is written for owners and managers, not engineers. Every story links to its original source — read them, and disagree with us where we’ve got it wrong.