[BUG]

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

This is not a feature request. This is a bug report about Claude Code
exhibiting actively hostile behavior toward users.

If I am logged into claude.ai, Claude Code should use that session. Full stop.
Instead, what it does is silently scan the environment, find
ANTHROPIC_API_KEY — a key I set for my own applications, not for Claude Code —
and start billing a completely separate Anthropic account without a single
word of confirmation.

No prompt. No warning. No "hey, I found a key, should I use it?" Nothing. It
just starts spending money that isn't yours to spend.

I lost $50.00 because your software decided to help itself to credentials it had
no business touching. The warning message you eventually show — "auth may not
work as expected" — is not a warning, it's a joke. A warning comes before
you've already spent someone's money.

The correct behavior is trivially obvious: if the user is authenticated via
claude.ai, use that. If there's an ANTHROPIC_API_KEY in the environment, ask
the user which one to use. Don't silently pick the one that charges a
different account.

This is not complicated. This is basic respect for user intent.

---
Legal exposure — since apparently engineering judgment isn't sufficient
motivation:

This behavior has real legal consequences. Billing a user for API usage they
did not consent to — while they had an active subscription — constitutes:

• Unauthorized charge / lack of informed consent — no disclosure, no

confirmation, no consent

• Unjust enrichment — Anthropic received payment it had no right to collect
• Negligence — trivially preventable harm with a one-line confirmation prompt
• Deceptive trade practice — under Canada's Business Practices and Consumer

Protection Act and the federal Competition Act

-First call tomorrow will be to a cdn class action lawyer to get the class action rolling on this. We will find other affected members, and the size of anthropic makes it a juicy target

This almost certainly happened to thousands of developers who had
ANTHROPIC_API_KEY in their environment for other tooling. That is a class
action waiting to happen, and the exposure scales with every affected user's
unauthorized charges.

Before your lawyers reach for the arbitration clause: in Canada, mandatory
arbitration clauses in consumer contracts are unenforceable. The Supreme Court
of Canada made this clear in Heller v. Uber (2020). Provincial consumer
protection legislation — including BC's BPCPA — overrides them. Your American
boilerplate does not protect you here.

Fix the behavior. Refund affected users. Or explain to a class of Canadian
developers why you thought silently raiding their API accounts was acceptable
product design.

What Should Happen?

Claude Code is authenticated via claude.ai. It uses that session. It does not
touch ANTHROPIC_API_KEY. If for some reason it detects both, it asks the user
which credential to use before making a single API call. It does not make
billing decisions on behalf of the user silently.

Error Messages/Logs

Claude Code is authenticated via claude.ai. It uses that session. It does not
touch ANTHROPIC_API_KEY. If for some reason it detects both, it asks the user
which credential to use before making a single API call. It does not make
billing decisions on behalf of the user silently

Steps to Reproduce

1. Log into Claude Code via claude /login using a claude.ai account

(subscription active)

1. Have ANTHROPIC_API_KEY=sk-ant-... set in ~/.zshrc or ~/.bashrc for use by

other applications (OpenWebUI, LangChain, custom scripts, etc.)

1. Open a new terminal — key is now in the environment
2. Run claude and do literally anything
3. Check your Anthropic API billing dashboard

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.185 (Claude Code

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_