[Security regression] Revoked Claude Code tokens still appear to consume Max usage after full logout
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
I believe this is a regression / recurrence of #43801.
I’m on Claude Max 20x. After a fresh 5-hour reset, my usage went from ~10% to 100% in about 10 minutes while I was not using Claude.
I already:
revoked all 15 Claude Code authorization tokens
confirmed zero connected Claude Code instances
ran /logout locally
logged out all devices
revoked Anthropic API keys
disabled Extra Usage
fully quit Claude Desktop
Usage still increased to 100%.
This looks either like:
previously revoked OAuth/access/refresh credentials are still accepted server-side, or
a severe usage-metering bug.
Related issue: #43801
Anthropic support has not responded yet. Could someone please investigate the server-side inference/auth logs and confirm whether all previously issued OAuth/refresh tokens for my account are actually invalidated?
What Should Happen?
invalidate session when you pretend it does
Error Messages/Logs
Steps to Reproduce
invalidate all from claude web
Claude Model
Not sure / Multiple models
Is this a regression?
No, this never worked
Last Working Version
_No response_
Claude Code Version
2.1.226
Platform
Anthropic API
Operating System
macOS
Terminal/Shell
Terminal.app (macOS)
Additional Information
_No response_