[BUG] VS Code extension resumes huge sessions without warning and rapidly exhausts Max usage

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I am on Claude Max $200/month. On 2026-06-25, my weekly usage went from about 50% to 100% in minutes after the Claude Code VS Code extension resumed very large local sessions without a clear warning or confirmation.

This was not caused by cron, systemd timers, or scheduled jobs. I captured the live process tree and found Claude Code native workers were children of VS Code extension hosts:

systemd --user -> gnome-shell -> code -> VS Code extension host -> claude

The dangerous workers were launched with:

--resume 363be589-7047-4d71-9e64-e6ac77afc550
--resume 71706514-ebd7-4afc-8843-6c3fcffd237c

The resumed sessions were very large:

• 363be589... transcript: about 629 MiB
• 71706514... transcript: about 23.4 MiB, 63 parsed image blocks, about 1,195 tool results

The resumed sessions used Opus and contained large accumulated context including tool results, image/base64 payloads, and long history. Resuming them appears to have rapidly consumed my Max weekly quota.

I have preserved local evidence with checksums, including transcripts, VS Code Claude logs, process snapshot, scheduled-job snapshot, and an incident report. I am not uploading the full transcripts publicly because they may contain private project data.

What Should Happen?

Claude Code should not silently resume very large local sessions from the VS Code extension.

Before resuming a large transcript, Claude Code should warn and require confirmation, especially above thresholds such as 10 MB, 50 MB, or sessions containing many image/tool-result blocks.

It should also provide:

• visible transcript/context size indicator before resume
• setting to disable automatic resume/session restore
• option to start a fresh summarized session instead of replaying full transcript
• warning that resuming a large Opus/image-heavy/tool-heavy session may rapidly consume Max usage

Error Messages/Logs

No application crash.

Relevant captured facts:

Claude Code VS Code extension:
anthropic.claude-code@2.1.183

Local CLI:
claude --version = 2.1.177

npm latest checked at report time:
@anthropic-ai/claude-code = 2.1.193

Live process evidence showed VS Code extension hosts launched native Claude workers with:

--resume 363be589-7047-4d71-9e64-e6ac77afc550
--resume 71706514-ebd7-4afc-8843-6c3fcffd237c

VS Code Claude logs showed both resumes from the corevecta-oep Claude webview at 2026-06-25 18:51 EDT.

No cron/systemd scheduled jobs were found launching Claude Code.

Steps to Reproduce

1. Use Claude Code in the VS Code extension long enough to create a very large local session with many turns, tool results, and image blocks.
2. Close/restart VS Code or allow VS Code to restore previous windows/panels.
3. Let the Claude Code VS Code extension reopen or resume previous sessions.
4. Observe native Claude Code workers launched by VS Code extension hosts with --resume against large session IDs.
5. Continue interacting with the resumed session.
6. Usage can be exhausted rapidly because the large transcript/context is replayed.

In my case, two sessions were resumed:

• 363be589-7047-4d71-9e64-e6ac77afc550: about 629 MiB
• 71706514-ebd7-4afc-8843-6c3fcffd237c: about 23.4 MiB

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Unknown; this behavior was first observed on 2026-06-25

Claude Code Version

VS Code extension: anthropic.claude-code@2.1.183 CLI: 2.1.177 npm latest at report time: 2.1.193

Platform

Other

Operating System

Ubuntu/Debian Linux

Terminal/Shell

VS Code integrated terminal

Additional Information

I have a preserved local evidence archive with checksums at:

/home/sali/.claude/session-archive/incident-20260625-185954

Archive contents include:

• incident report
• copied transcripts for both resumed sessions
• quarantined original session files/directories
• VS Code Claude extension logs
• live Claude process snapshot
• scheduled jobs snapshot
• VS Code settings after mitigation
• SHA256SUMS.txt

I also contacted Anthropic support. Support conversation ID:
215474851029148

Related public issues:

• #41866: extreme Claude Code token burn reports
• #40524: conversation history/cache invalidation around resumes
• #42256: image payloads remaining in context and being re-sent
• #42609: session limit hit rapidly while resuming an old task

Important privacy note:
I am not attaching the full 629 MiB and 23.4 MiB transcripts publicly because they may contain private project data. I can provide sanitized excerpts or metadata privately if Anthropic needs them.

Mitigation already applied locally:

• killed live Claude Code native workers
• moved the two dangerous original session files/directories out of the active ~/.claude/projects path
• disabled VS Code window restore with "window.restoreWindows": "none"
• disabled Claude Code reopen closed session shortcut
• changed Claude Code initial permission mode to default