[Bug] Excessive cache_read tokens consuming daily quota (95.3% of 33.2M tokens)

Bug: Interrupted session consumed 20.7M cache_read tokens with only 215 input tokens

Claude Code version: (check your version)
Platform: macOS (Apple Silicon M4 Pro)
Date observed: 2026-04-06

---

Summary

An interrupted session — first prompt was literally [Request interrupted by user for tool use] — consumed 20,751,058 cache_read tokens with only 215 input tokens and 0 subagents. The session was cancelled before doing any meaningful work.

---

Evidence

Audited using @kieranklaassen's token analysis script which reads JSONL logs from ~/.claude/projects/.

1-day report (2026-04-06):

| Metric | Value |
|---|---|
| Total main-session tokens | 33,209,206 |
| cache_read | 31,661,943 (95.3%) |
| input | 446 |
| output | 122,930 |
| Subagent sessions | 16 (14,893,989 tokens) |

Offending session:

| Field | Value |
|---|---|
| Session ID | 9579ff9b-78d2-45cd-a04d-3fdf1a7b9b57 |
| Started | 2026-04-06 18:07:47 |
| Total tokens | 21,208,123 |
| input_tokens | 215 |
| cache_read_input_tokens | 20,751,058 |
| output_tokens | 42,801 |
| Subagents | 0 |
| First prompt | [Request interrupted by user for tool use] |

cache_read / input ratio: 96,517 : 1

---

Why this matters

A session that the user explicitly interrupted — with no subagents, no file reads, no tool calls completing — should not accumulate 20+ million cache_read tokens. This consumed a significant portion of paid usage quota for work that was never done.

This is consistent with the publicly reported Claude Code usage drain issue observed between 2026-03-28 and 2026-04-06, where users saw context/cache tokens consuming quotas at abnormal rates.

---

Steps to reproduce

1. Open Claude Code in any project
2. Begin a session (any prompt)
3. Interrupt it immediately (Ctrl+C or tool use cancellation)
4. Run the token analysis script: uv run token_analysis.py
5. Check cache_read tokens for that session in ~/.claude/projects/<project>/<session>.jsonl

---

Expected behavior

An interrupted session with minimal input should consume near-zero cache_read tokens.

Actual behavior

20,751,058 cache_read tokens consumed for a session with 215 input tokens that was cancelled before completion.

---

Additional context

• 10-day aggregate: 322.9M main-session tokens, 300.9M were cache_read (93.2%)
• Pattern consistent across multiple sessions: cache_read dominates even when actual work is minimal
• Script used for analysis: https://gist.github.com/kieranklaassen/7b2ebb39cbbb78cc2831497605d76cc6