Two Claude Code sessions ate 32% of a team's bill

Two Claude Code sessions ran up 32% of a ten-person team's monthly bill, according to PromptArmor's audit of 30 days of Claude Code and Cowork telemetry. Both sessions were kept open and resumed daily for more than a week. The same data shows plaintext credentials going to Anthropic in 9% of model calls.

At a glance

• PromptArmor analyzed 310,009 OpenTelemetry events from Claude Code and Cowork. The events came from a cross-functional team of ten at an anonymized enterprise partner and cover 30 days.
• Cache reads, where the agent re-reads its own conversation, made up 97% of tokens across every model. Even at a tenth of the input rate, they accounted for about 68% of spend.
• Half of all tool calls ran more than 10 LLM steps after the user's last message. One rm -rf command ran 920 steps after the last user interaction.

If you have not been following PromptArmor, this is not its first look at Anthropic's agents. According to PromptArmor, it disclosed a Claude Cowork vulnerability two days after the Cowork research preview launched. The flaw let attackers exfiltrate files through indirect prompt injection. The same source says researcher Johann Rehberger first found the underlying issue in Claude.ai chat, and that Anthropic acknowledged it at the time but did not fix it.

Twelve sessions that cost more than $300 each took 65% of the spend

Spend was very uneven. The cheaper half of the 342 sessions accounted for just 2% of the bill. At the other end, 12 sessions cost more than $300 each and together took 65% of spend. That group is the 4% of sessions in the report's headline.

Two of those sessions cost between $1,000 and $3,000 each and together came to $5,079, or 32% of spend. Both ran mostly on Fable 5, and both were kept open and resumed daily for over a week. As a result, every LLM call in them paid for an average of about 500k cached tokens of context.

PromptArmor describes this as part of a wider pattern. A small share of agent tasks and a small group of power users on the team accounted for most of the money spent during the month.

Claude printed credentials 66 times, and secrets rode along on 9% of model calls

Usually Claude handled secrets carefully. On 2,979 occasions it used a credential without reading it. For example, it passed a secret to a child process without printing it, or set it in an HTTP header from code. That keeps the value out of the model's context.

But 66 times it printed a credential outright. That is only about 2% of credential uses. A printed value stays in context until compaction, though, so plaintext secrets went out with 5,840 of the 65,892 LLM API calls to Anthropic, across 32 of 342 sessions. Each value also lands in the session transcript and, depending on configuration, in the OTel logs.

A little under half of the 66 reads pulled a credential from the team's secrets manager. About a third dumped the environment of a running process. The rest printed a local .env file, a cluster secret or a macOS keychain entry. In every case the value stayed in context, where an indirect prompt injection could go after it.

MCP servers supplied 52% of the 135 MB of untrusted text

In 1,308 turns, 14% of the total, Claude read external text that could carry a prompt injection. MCP servers were the biggest source with 70.1 MB. Web fetch followed with 44.5 MB (33%), then web search with 16.5 MB (12%) and shell commands reaching external hosts with 3.9 MB (3%).

The median turn of this kind read 2.9 KB. One in ten read more than 141 KB, one in a hundred more than 833 KB, and twelve turns read more than 1 MB each. The team made 3,500 MCP calls across 49 servers, averaging 20 KB each. That is almost five servers per person, and the largest single result was 1.07 MB.

Web results first go through Haiku, which pulls out the relevant parts before they reach the main agent. PromptArmor notes that this lowers the injection risk but does not remove it, because injected text tends to present itself as important. Separately, Claude contacted 255 external hosts via bash. They ranged from APIs like GitHub to arbitrary websites fetched with curl.

Half of all tool calls came more than 10 steps after the last prompt

A turn is everything the agent does after one user prompt. A step is one round of thinking and calling tools, including the steps of any subagents. The median prompt was 86 characters long and the median turn made 3 model calls. But one turn in a hundred took more than 72 steps, and the longest took 1,102.

One in ten tool calls came more than 160 steps after the user's last prompt, and one in a hundred more than 782. Risky commands, meaning deletes, pushes, commits and network calls, stayed closer to the user, at a median of 5 steps. Still, one in ten came more than 56 steps out.

Claude contacted 650 external hosts in total, and 56% of those connections happened more than 10 LLM calls after the user's last message. Measured in time, 13% of turns ran more than five minutes with no human input. Another 2% ran more than fifteen minutes, and under 1% more than an hour.

Fable 5 cost 50% more than Opus 5 while doing 45% fewer tasks

The team used eight models, but Fable 5 and Opus 5 took 89% of spend between them. Fable 5 took 54% ($8,573) on 27% of model calls. Opus 5 took 36% ($5,699) on 50% of calls. Haiku 4.5 handled 5% of calls for under 1% of spend ($46). Those calls included 2,067 that preprocessed web results, plus session titles.

Two factors explain the gap. A Fable 5 call carried 319,000 tokens on average, compared with 201,000 for Opus 5. Fable also cost $1.31 per million tokens, blended across input, output and cached tokens, against $0.75 for Opus. So an average Fable call cost $0.42 and an average Opus call cost $0.15.

Cache reads do the rest. On every step the agent sends its whole conversation back to the model, and it pays for those tokens at a tenth of the input rate: $1.00 per million on Fable 5, $0.50 on Opus 5. Think of a copier that charges a cent a page but reprints the whole file each time you add a page. It stays cheap until the file is huge and you keep going all week.

The report has clear limits. It covers one team of ten at one anonymized partner over one month, so the spend pattern may look different elsewhere. It counts credential exposures but says nothing about whether any secret was misused. In our view, the priciest finding is also the easiest to fix: two sessions reached 32% of spend mostly by staying open for over a week, and starting fresh sessions would likely have cut that.

Dynamic Workflows and 1000 subagents

PromptArmor says tracking costs is becoming a priority because of Claude's Dynamic Workflows, which let an agent spawn up to 1000 subagents for one task. The report gives no figures from teams that already use it, so we do not yet know how the step counts and cache bills above change at that scale. The same OTel collector setup that produced this data is the obvious place to watch.