Two Claude Code sessions ate 32% of a team’s bill

At one ten-person team, 4% of Claude Code and Cowork sessions accounted for 65% of a month’s spend, and the two most expensive sessions alone took 32%. The figures come from a Promptarmor analysis published September 24, built on 310,009 OpenTelemetry events collected over 30 days at an unnamed enterprise partner.

The cheaper half of all sessions added up to 2% of the bill. The data covers 342 sessions and 65,892 model calls. In Claude Code, telemetry is off by default. It is switched on with CLAUDE_CODE_ENABLE_TELEMETRY=1 plus a choice of exporters, and administrators can set it for every user through the managed settings file. Anthropic’s monitoring documentation says a repository’s own .claude/settings.json cannot turn telemetry on or choose where it goes.

Where the money goes

Across all models, 97% of tokens were cache reads, which is the agent re-reading its own conversation on every call. Cache reads are billed at a tenth of the input rate: $1.00 per million tokens on Fable 5 and $0.50 on Opus 5. Even at that discount they made up about 68% of spend. A long session sends its whole history again with each model call, and almost every token in that history is billed as a cache read.

The model mix explains most of the rest. Eight models were used, and two of them took 89% of the money. Fable 5 accounted for 54% of spend ($8,573) on 27% of model calls. Opus 5 accounted for 36% ($5,699) on 50% of calls. The average Fable 5 call carried 319,000 tokens, against 201,000 for Opus 5. Blended across input, output and cached tokens, Fable 5 came to $1.31 per million tokens and Opus 5 to $0.75. So the average call cost $0.42 on Fable 5 and $0.15 on Opus 5.

Both of the two biggest sessions ran mostly on Fable 5. Each was kept open and resumed daily for more than a week, which left an average of about 500,000 cached tokens of context billed on every call. Together the two sessions cost $5,079, and the next ten, each between $300 and $1,000, cost $5,233. Promptarmor says this continues a pattern on the team: a small share of tasks and a small group of power users make up most of the spend.

Haiku 4.5 sits at the other end, with 5% of calls and under 1% of spend. Most of those calls were support work for the harness: 2,067 calls to boil down web fetch and web search results before they reach the main model, plus generating session titles.

Secrets that stay in context

The same persistence also spreads credentials. In most cases Claude used a credential without reading it, for example by handing a secret to a child process without printing it, or by setting it in an HTTP header from code. It did that 2,979 times in the study period. It printed a credential outright 66 times, about 2% of credential uses. Each printed value stays in context until compaction, so it rides along on every later call: plaintext secrets went to Anthropic in 5,840 of the 65,892 model calls, or 9%, across 32 of the 342 sessions.

Of the 66 reads, a little under half pulled a credential from the team’s secrets manager, about a third dumped the environment of a running process, and the rest printed a local .env file, a cluster secret or a macOS keychain entry. Promptarmor lists three consequences. The value is sent to Anthropic on every following call. It stays in the session transcript and, depending on configuration, in the OTel logs. And it sits in the agent’s context, where an indirect prompt injection can go after it.

Outside text, long after the prompt

That injection risk depends on how much outside text the agent reads. In 14% of turns (1,308), Claude read untrusted external data, 135 MB in total. MCP servers supplied 70.1 MB (52%), page fetches 44.5 MB (33%), web search results 16.5 MB (12%), and shell commands that reached an external host 3.9 MB (3%). The ten people used 49 MCP servers between them, almost five each, over 3,500 calls averaging 20 KB. The largest single MCP result was 1.07 MB. The Haiku step trims web data before the main agent sees it. Promptarmor argues this lowers the injection risk without removing it, because injected text tends to present itself as important and can get Haiku to pass it along.

Much of the activity also runs far from the last human message. The median prompt was 86 characters, and the median turn made three model calls. But the median tool call came 10 steps after the user’s last message, counting the steps of any subagents. One in ten came more than 160 steps out, and one in a hundred more than 782. Of the 650 external hosts contacted, 56% of the connections were made more than 10 calls after the user last spoke. And 13% of turns ran for over five minutes with no human input, 2% for over fifteen minutes.

Commands that delete files, commit, push code or reach the network stayed closer to the user, at a median of five steps. One in ten was more than 56 steps out. One rm -rf ran 920 steps after the last user interaction.