[BUG] Silent default model upgrade to Opus 4.7 caused $506 in unexpected charges over 6 days

Summary

Claude Code silently changed its default model from claude-sonnet-4-6 to claude-opus-4-7 with no notification. This triggered 15 automatic recharges and $506.07 in unexpected API charges over 6 days.

Environment

• Platform: macOS 14 (Darwin 24.5.0)
• Claude Code: latest (as of 2026-06-20)
• API key created: 2026-06-20

What happened

Exact switch moment (from transcript logs)

| Time (UTC) | Event |
|---|---|
| 2026-06-20 02:01:15 | Last claude-sonnet-4-6 API call |
| 2026-06-20 02:09:45 | First claude-opus-4-7 API call |

The default model changed within 8 minutes, with no action taken by the user and no notification displayed. This coincided with creating a new API key — but neither the key creation flow nor any UI prompt indicated the model had changed.

Financial impact

| Date | Opus 4.7 calls | Estimated cost |
|---|---:|---:|
| 2026-06-20 | 505 | ~$283 |
| 2026-06-21 | 388 | ~$463 |
| 2026-06-22 | 62 | ~$174 |
| 2026-06-23 | 474 | ~$308 |
| 2026-06-24 | 333 | ~$324 |
| 2026-06-25 | 905 | ~$2,156 |

Total on this key: $506.07 (per Anthropic Console)
Auto-recharge triggered: ~15 times — because there was no mechanism to detect the unexpected cost escalation.

Opus 4.7 is priced at approximately 5× Sonnet 4.6. The same workload that cost ~$5–$90/day on Sonnet was now costing $170–$460/day on Opus.

Note: The estimated figures in the table above use a cost formula applied to raw token counts from local transcripts and do not exactly match Console figures, but they accurately reflect the relative scale and day-by-day pattern.

Root cause hypothesis

Claude Code appears to have updated its hardcoded or packaged default model to claude-opus-4-7. Because ~/.claude/settings.json did not contain an explicit model key, every new session silently adopted the new default. There was no changelog entry, no in-app notification, and no warning at session start.

Why this matters

1. No user consent: The model change directly affects per-token pricing. Changing the default to a 5× more expensive model without explicit user notification is a significant breaking change in terms of cost.
2. Auto-recharge amplifies the damage: Users with Auto-recharge enabled have no natural circuit-breaker when cost suddenly spikes due to a silent default change.
3. No observability: Claude Code does not display the active model prominently at session start. Related: #63205.
4. settings.json is the only safeguard, but users are not told to set it explicitly. Related: #65476.

Requested fix / mitigation

1. Notify users prominently (at session start or via changelog) when the packaged default model changes — especially when the new default is more expensive.
2. Show the active model in the status line by default so users can detect unexpected model switches immediately.
3. Prompt users to confirm or pin their model preference when a default model upgrade is detected for the first time.
4. Consider adding a cost-spike warning when per-session token cost significantly exceeds the user's recent average.

Workaround (applied)

Added to ~/.claude/settings.json:

{
  "model": "claude-sonnet-4-6"
}

This pins the default and prevents future silent upgrades — but users should not have to discover this themselves after incurring hundreds of dollars in unexpected charges.

---

Happy to provide redacted transcript data or Console screenshots if helpful.