Claude telemetry: 4% of sessions ran up 65% of the bill

Two Claude sessions, kept open and resumed every day for more than a week, ran up 32% of a ten-person team's spend over a month, according to PromptArmor's analysis of 30 days of OpenTelemetry data. Across 310,009 events logged in Claude Code and Cowork, 4% of sessions accounted for 65% of the bill.

At a glance

• PromptArmor studied telemetry from one anonymized enterprise team of ten. It asked two questions organizations care about most: which agent risks actually show up in practice, and what drives cost.
• Cache reads, where the agent re-reads its own conversation, made up 97% of tokens and about 68% of spend. Fable 5 took 54% of the bill on 27% of model calls.
• Claude printed credentials 66 times, which left plaintext secrets in 9% of model calls. The write-up covers a single team and does not say what the costliest sessions were doing.

Claude, like many agentic tools, supports OpenTelemetry (OTel). An administrator runs a collector and receives events from user sessions, from tool call approvals to the cost of each request. PromptArmor says cost tracking is becoming a priority as features like Claude's Dynamic Workflows roll out, because they let one agent spawn up to 1000 subagents for a single task.

Fable 5 took 54% of the bill on 27% of model calls

The cheaper half of all sessions produced only 2% of the bill, while the 12 sessions that cost more than $300 each produced 65%. The two costliest ran mainly on Fable and came to $5,079 together. On every LLM call they paid for an average of roughly 500,000 cached tokens of context.

Eight models appeared in the data. Fable 5 cost $8,573, or 54%, on 27% of model calls, and Opus 5 cost $5,699, or 36%, on 50%. PromptArmor traces the gap to context and price. An average Fable 5 call carried 319,000 tokens against 201,000 for Opus 5, at a blended $1.31 per million against $0.75. That put the average call at $0.42 on Fable 5 and $0.15 on Opus 5.

Across every model, 97% of tokens were cache reads. They are billed at one tenth of the input rate, $1.00 per million on Fable 5 and $0.50 on Opus 5, and still made up about 68% of spend. Haiku 4.5 handled 5% of calls for under 1% of spend. That included 2,067 calls to preprocess web fetch and web search results, plus work like generating session titles.

Claude printed credentials 66 times, and they rode along on 5,840 calls

Claude is trained to use secrets without reading them, for example by passing one to a child process or by setting it in an HTTP header in code. It did that 2,979 times during the month. In 66 cases, about 2% of credential uses, it printed the value outright instead.

A printed secret stays in context until compaction, so it goes out with every later request. The 66 prints put plaintext credentials into 5,840 of 65,892 LLM API calls to Anthropic, or 9%, across 32 of 342 sessions. The value also lands in the session transcript and, depending on configuration, in the OTel logs, and an indirect prompt injection can target it for exfiltration.

A little under half of the 66 insecure reads fetched a credential from the team's secrets manager, and about a third dumped the environment of a running process. The rest printed a local .env file, a cluster secret or a macOS keychain entry.

MCP servers supplied 70.1 MB of the 135 MB of untrusted text

In 1,308 turns, 14% of the total, Claude read text from outside the organization, 135 MB in all. MCP servers supplied 70.1 MB (52%), web fetch 44.5 MB, web search 16.5 MB, and shell commands reaching external hosts 3.9 MB. The median such turn read 2.9 KB, and twelve turns read more than 1 MB each.

The team made 3,500 MCP calls averaging 20 KB across 49 servers, almost five per person, and the largest single result was 1.07 MB. In all, 650 external hosts were contacted, and 56% of those connections came more than 10 LLM calls after the user's last message. Beyond web retrieval, 255 external hosts were reached via bash. They were a mix of service APIs such as GitHub and arbitrary websites fetched with curl.

Web data passes through a filter first. Claude's harness has Haiku preprocess fetched pages and search results and pass on only the relevant parts, so only a fraction of the 61 MB they returned reached the main agent. PromptArmor notes that this lowers the injection risk without removing it, because injected text tends to present itself as important and can talk Haiku into passing it along.

Half of tool calls ran more than 10 steps after the last prompt

After a prompt, Claude works in a loop. The model reads the context, calls a tool, reads the result, then stops or keeps going. A turn is everything after one prompt, and a step is one round of thinking and calling tools, with subagents counted. Picture a contractor who takes one short phone call, then keeps working and placing orders without calling back.

The median prompt was 86 characters and the median turn made 3 model calls. Still, one turn in a hundred ran past 72 steps, and the longest ran 1,102. Half of tool calls came more than 10 steps after the last user message, one in ten more than 160, and one in a hundred more than 782.

Commands that delete files, commit, push code or reach the network sat closer to the user, at a median of 5 steps. Even so, one in ten ran more than 56 steps out, and one rm -rf ran 920 steps after the last human input. Of all turns, 13% ran over five minutes with no human input, 2% over fifteen minutes and under 1% over an hour.

The data covers one anonymized team over a single month, so these shares describe one team's habits. The write-up also does not say what the two most expensive sessions were working on. In our view, the costliest pattern here also looks like the easiest to change: sessions resumed daily for over a week paid for about 500,000 cached tokens on every call.

Where Opus 5.5 fits in According to Claude's site, Claude Opus 5.5 launched on September 22, 2026. It is described as performing at the level of Claude Fable 5.1 on most work while costing 40% less to run than Opus 5. The PromptArmor data does not include it. Whether it would shrink a bill like this one is an open question, because cache reads made up about 68% of spend across every model.