Claude Code Continues Logging Sessions After Revoke, User Reports 2-Week Support Silence
TL;DR: A user reports that Claude Code continued to log sessions and consume tokens even after revoking access via the UI. Anthropic support has been unresponsive for two weeks. If you use Claude Code, check your usage logs at claude.ai/settings/usage to verify sessions stop after revoking access.
What happened
The user noticed session logs appearing in their usage dashboard with scopes user:file_upload, user:ccr_inference, and user:sessions:claude_code after they had already revoked Claude Code's access. The revoke button in the UI appeared to do nothing.
Steps taken to stop it
- Uninstalled the CLI
- Deleted all local credentials and configs
- Checked for rogue API keys — none found
- Verified the Connectors page was clean
Despite all this, logs continued. The user opened a support ticket. The Fin AI bot promised a quick human response, but after two weeks, there has been no reply.
What to check
If you use Claude Code and care about what's running under your account, check your usage logs at claude.ai/settings/usage and verify your sessions actually stop after revoking access.
No known fix yet
The user notes that this might not be a universal bug, but it highlights a potential issue with access revocation in Claude Code's current implementation. There's no suggestion of a better way to reach Anthropic support in the source.
📖 Read the full source: r/ClaudeAI
👀 See Also
OpenClaw's 'Allow Always' Feature Security Flaws and Safer Alternatives
OpenClaw's 'allow always' approval feature has been the subject of two CVEs this month, allowing unauthorized command execution through wrapper command binding and shell line-continuation bypasses. The deeper issue is how the feature trains users to stop paying attention to security prompts.
Using Claude to audit OpenClaw setup reveals security issues
A developer used Claude to review their OpenClaw installation and discovered the bot was writing API keys in clear text in memory and JSON files, along with other security concerns.
Claude Code --dangerously-skip-permissions vulnerability and open-source defense tool
Lasso Security published research showing indirect prompt injection vulnerabilities in Claude Code when using --dangerously-skip-permissions flag, with attack vectors including poisoned README files, malicious web content, and MCP server outputs. They released an open-source PostToolUse hook that scans tool outputs against 50+ detection patterns.
5 Malicious OpenClaw Skills That Passed ClawScan + VirusTotal: Unit 42 Analysis
Unit 42 found 5 malicious OpenClaw skills that bypassed ClawScan and VirusTotal. Techniques included runtime referral swapping, SOL pooling for pump-and-dump, and 22MB README padding to hide an AMOS dropper.