Claude Code Has Two Cache Bugs That Silently 10-20x Your API Costs, and Someone Reverse-Engineered the Root Cause

A developer took a 228MB Claude Code standalone binary, cracked it open with Ghidra, ran a MITM proxy and radare2, and identified two independent bugs causing prompt cache to break silently. The result: API costs inflated by 10-20x with no user-visible warning.

The first bug: non-deterministic tool definition ordering. Claude Code's API calls include tool definitions, and their order isn't stable across requests. When the order changes, the cached prefix becomes invalid and the entire prompt gets reprocessed at full price. On a 100K+ token context (which you hit quickly in any real coding session), that's the difference between paying for 10K tokens and paying for 100K tokens. Every. Single. Request.

The second bug: system prompt mutations that invalidate cached prefixes. The system prompt changes in ways that break cache continuity, forcing full recomputation even when the actual conversation content hasn't changed.

Cached tokens cost 10% of regular input tokens on Anthropic's API. So when caching breaks, you're paying 10x more per input token, compounded across every request in a session. On extended coding sessions with large contexts, the cost difference is enormous. And there's no dashboard indicator, no warning, no error message. Your bill just goes up.

This finding connects directly to the viral r/ClaudeAI post about a Claude Max 20x plan ($200/month) getting burned through in 19 minutes. If you're on the API, you've been bleeding money. If you're on Max, you've been burning rate limits at 10-20x the expected rate.

What you should do right now: check your API billing for unexpected cost spikes. If you're running Claude Code through the API on large codebases, compare your cached vs. uncached token ratios. If caching is working correctly, you should see high cache hit rates on sequential requests within the same session. If you're seeing mostly uncached reads, you're hitting one or both of these bugs.

The reverse-engineering methodology itself is worth studying. Ghidra + MITM proxy on a standalone binary to debug API cost anomalies. That's the kind of detective work that saves teams real money.

Source: r/ClaudeAI (255 upvotes, 38 comments)