Claude Code CLI usage incorrectly classified as API billing on Max subscription

Bug

Claude Code CLI usage on a Max 5x subscription is being classified/billed as API usage rather than subscription usage. This started around April 4th 2026.

Environment

• Platform: Ubuntu Linux VM (Oracle Cloud)
• Claude Code: CLI, invoked both interactively and via cron (subprocess calls)
• Subscription: Max 5x (default_claude_max_5x rate limit tier)
• Auth method: OAuth only (claudeAiOauth in ~/.claude/.credentials.json)

Audit confirms no API key override

Full VM audit performed 2026-04-09. No ANTHROPIC_API_KEY is set anywhere:

| Location checked | Result |
|---|---|
| Current environment (env) | Not set |
| ~/.bashrc, ~/.profile | Not present |
| /etc/environment, /etc/profile.d/ | Not present |
| Crontab | Not present |
| All .env files across projects | Not present |
| All project source code (.py, .sh, .yaml) | Not present |

The only API key on the VM is GEMINI_API_KEY (for Google Gemini CLI, unrelated).

Authentication details

{
  "claudeAiOauth": {
    "scopes": ["user:inference", "user:profile", "user:sessions:claude_code"],
    "subscriptionType": "max",
    "rateLimitTier": "default_claude_max_5x"
  }
}

How Claude is invoked

All automated (cron) usage calls Claude via CLI subprocess:

claude --dangerously-skip-permissions --model sonnet -p <prompt>

No API key is passed. The CLI uses the OAuth credentials from ~/.claude/.credentials.json.

Expected behaviour

All CLI usage should be covered by the Max subscription, not billed as API usage.

Actual behaviour

Usage is appearing as API billing rather than subscription usage. Anthropic support (Fin AI Agent) suggested an ANTHROPIC_API_KEY override as the cause, but as audited above, no such key exists on this system.

Reproduction

This is a billing/classification issue on the backend — the client-side config is correct. The issue may be related to how --dangerously-skip-permissions subprocess calls are classified, or a backend change around April 4th.