[BUG] Severe phantom token drain while powered off leading to false-positive Safeguards suspension

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I am experiencing a massive, unexplained usage drain that occurs without manual input and even while the primary machine is powered off. This anomaly has subsequently triggered an automated Safeguards suspension.

Timeline of Anomalies:

• Sep 30, 01:20–05:30 CEST: Local transcript logs recorded approximately 156 million tokens (calculated by summing usage once per unique request deduplicated by message ID, mostly cache reads) while I was away from the machine.
• Oct 1, 10:44–15:33 CEST: The displayed 5-hour usage quota increased from 0% to 100% and the weekly quota from 63% to 79%. During this entire interval, my primary iMac was completely powered off. I did not initiate new prompts on any other client, the backup Oracle VM had no scheduled cloud routines initiating Claude requests, and I had no active Cowork tasks.

Enforcement Action:
I reported these anomalies to in-app support under Conversation ID: 215476177014766. Because /usage did not provide a subagent breakdown, I explicitly requested a human review of account-side activity. The support assistant stated the request would be passed to a human agent.

Shortly after, on October 4, 2026, the automated Safeguards system suspended my account for "suspicious signals." I believe this is a false positive directly associated with the unexplained token drain I was trying to report. I cannot yet determine whether these observations reflect unexpected background execution, delayed usage reporting by the server, an accounting issue, or another cause.

Request:
I am submitting a formal appeal via the official form. Could the appropriate Safeguards or engineering team review support conversation 215476177014766 alongside this enforcement action to determine whether the suspension is related to this reported usage bug?

What Should Happen?

Usage quota and token counts should accurately reflect actual user-initiated commands and background execution without unexplained, massive spikes during idle periods or when the host machine is completely powered off. Additionally, automated security suspensions should not trigger based on server-side reporting anomalies or phantom traffic that has been formally reported for investigation.

Error Messages/Logs

Steps to Reproduce

1. Initiate background Claude Code sessions on macOS (iMac).
2. Allow sessions to complete or run naturally; monitor transcript logs and quota usage via /usage.
3. Observe anomalous spikes in transcript token counts during idle periods (e.g., ~156M tokens recorded on Sep 30 between 01:20 and 05:30 CEST, mostly cache reads).
4. Power off the primary iMac completely.
5. Check usage quota from a secondary device or after rebooting during a period of zero client activity (e.g., Oct 1, 10:44–15:33 CEST).
6. Observe the displayed 5-hour quota increase from 0% to 100% and weekly quota jump from 63% to 79% despite no active prompts or clients running.

Claude Model

Not sure / Multiple models

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.289 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_