Claude Code has been found to have two caching bugs that could silently increase API costs by 10-20 times.

PANews reported on March 31 that, according to 1M AI News, a developer reverse-engineered a 228MB binary file of the standalone Claude Code installer using Ghidra, MITM proxy, and radare2. The developer discovered two separate caching bugs that could increase API costs by 10-20 times without the user's knowledge. The analysis has been submitted to GitHub (issue #40524) and has been flagged as a regression bug by Anthropic and assigned for handling.

The first bug exists in the custom Bun runtime used in the standalone installation; an incorrect billing identifier replacement logic causes a full cache rebuild to be triggered on every request. The second bug affects users who use `--resume` or `--continue` to resume sessions; introduced in v2.1.69, a cache prefix mismatch causes the entire conversation history to be rewritten instead of read from the cache. Anthropic engineers had previously confirmed that user usage limits were being met "far faster than expected."