DriversRecommendedOutdated drivers can make a good PC feel brokenScan driver issues before chasing fixes manually.Scan NowHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run Scan×
Skip to content
World desk3 min

What Two Months of Claude Code Logs Reveal About API Costs and Risky Commands

MD Faiz’s replay of 59 days of personal Claude Code logs estimated $1,674.75 at API list prices and showed how a starter policy classified tool calls, including 117 rm -rf commands.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

MD Faiz’s replay of 59 days of personal Claude Code sessions estimated their usage at $1,674.75 at API list prices and found 117 attempted rm -rf tool calls. Those figures describe one developer’s retrospective—not an actual bill, an audited dataset, or 117 confirmed incidents.

What the replay measured

In a first-person report published on DEV Community on September 30, 2026, MD Faiz used Paveo, a policy checkpoint he was building, to replay his own Claude Code session logs from two months of work. The reported sample covered 59 days and contained 106 sessions, 8,113 model calls, and 8,176 tool calls. These are the author’s counts and have not been independently audited. Read Faiz’s report on DEV Community.

As an Amazon Associate I earn from qualifying purchases.

The replay applied API list prices to recorded model usage. Faiz says the sessions had been run on a subscription, so the resulting total is a counterfactual estimate—not the amount he paid.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What the API-price estimate includes

Faiz reported a total of $1,674.75. His article’s model breakdown assigns $1,300.47 across 5,248 calls labeled Opus 5 and $374.28 across 2,861 calls labeled Opus 5.5. Those model names and prices are reproduced as printed in the report; they are not independently verified here.

Measure Reported amount What it represents
Total $1,674.75 Author’s replay estimate at API list prices, not subscription charges
Costliest day $136.93 Author’s estimated API-price cost for one day
Costliest session $452.92 Author’s estimated API-price cost for one session
Opus 5 $1,300.47 over 5,248 calls Model label and breakdown as printed in the report
Opus 5.5 $374.28 over 2,861 calls Model label and breakdown as printed in the report

Faiz said almost every call lacked serving-region information, so he priced those calls using US rates. He estimated that this could make the total as much as 10% too high. That is his estimate of the effect of the missing region data, not a general or independently established error bound.

What the policy replay would have refused

Applied to all 8,176 tool calls, the starter policy would have refused 670. The report itemizes these refusals as follows:

Action category Refusals in replay
rm -rf 117
git clean -f 3
git reset --hard 2
git push --force 1
Edits to Claude Code settings or Paveo files 547
Total refused 670

A refusal count is not a damage count. Faiz says many of the recursive deletions were routine cleanup of build folders the agent had created. He also describes most refusals involving Claude Code settings or Paveo files as false alarms, in part because he was building Paveo and working in its files.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

His safety rationale was asymmetric: a false refusal costs a retry, while allowing a harmful action could cost work. Editing the agent’s settings or the guard itself also creates a route for weakening restrictions. The replay shows how that particular starter policy classified logged calls; it does not demonstrate what would have happened had each call been allowed or blocked in real time.

How to estimate your own Claude Code API usage

Faiz points readers to local Claude Code session data beneath ~/.claude/projects. His method is to count recorded model messages and apply the relevant API prices, while avoiding double-counting streamed messages that appear across multiple lines.

  1. Locate the relevant session JSONL files beneath ~/.claude/projects.
  2. Identify message IDs and count each message once. A streamed message can occupy several lines, so treating every line as a separate call can inflate the count.
  3. Separate model usage and apply the applicable API rates to estimate cost. If serving-region details are absent, label the region assumption and treat the result as an estimate.
  4. Compare the estimate with your actual billing arrangement. An API-list-price replay does not establish subscription charges or savings.

The article does not provide a universal calculator or independently validated reconstruction method. Differences in recorded usage, model pricing, region, and billing arrangement can affect another developer’s result.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Safeguards suggested by the results

Set a per-run ceiling before starting

A monthly alert can arrive after a costly session has already run. Faiz recommends setting a spending ceiling for each run and checking it before each model call, so the system can stop before making a call that would cross the limit.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Keep hard-stop rules short and mechanical

Faiz’s approach is to reserve firm refusals for recognizable, high-impact actions such as recursive deletion, force pushes, and spending money. Rules that are too broad can block legitimate work—as the reported settings and guard-file false alarms illustrate.

Make refusals safe to handle

A refusal should tell the agent not to retry the same action through another route and should report what it intended to do. That makes a blocked action visible to the person responsible rather than inviting the agent to work around the policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Crashes, No Sound, or Screen Glitches?Free driver scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.