Capital One’s Security Agent Tries to Disprove Its Own Findings
Security scanners already produce more credible-looking alerts than most teams can afford to investigate. On July 16, 2026, Capital One released VulnHunter,…
If you have both a Claude subscription (Pro/Max) and an ANTHROPIC_API_KEY environment variable set, Claude Code will use the API key and bill you at pay-as-you-go rates instead of using your subscription. This happens even when you're logged in, and it's documented behavior from Anthropic.
Subscription billing has fixed monthly costs and usage limits. API billing charges per token which can get expensive very quickly.
Claude Code prioritizes environment variable API keys over authenticated subscriptions. If ANTHROPIC_API_KEY is set, that's what gets used for billing.
In Claude Code, run:
/status
In your terminal, run:
echo $ANTHROPIC_API_KEY
If the second command returns a value, you're being billed via the API.
If you want Claude Code to use your subscription, you need to remove the API key from your environment.
Step 1: Find where the API key is set
The API key is likely in one of these files:
~/.zshrc (if you use zsh, which is default on macOS)~/.bashrc (if you use bash)~/.bash_profile (older bash setup)~/.profile (generic shell profile)Open each file and look for a line like:
export ANTHROPIC_API_KEY=sk-ant-...
Step 2: Delete that line
Remove the entire export ANTHROPIC_API_KEY=... line from the file and save it.
Step 3: Clear it from your current terminal
The change won't take effect in your current terminal until you either restart it or run:
unset ANTHROPIC_API_KEY
Step 4: Verify it's gone
Run this to confirm:
echo $ANTHROPIC_API_KEY
It should print nothing.
If you need the API key for other scripts but want Claude Code to use your subscription, you need to keep them separate.
Step 1: Remove the API key from your main shell profile
Follow Steps 1-4 from Option 1 above to remove it from ~/.zshrc or ~/.bashrc.
Step 2: Create a separate file for API work
Create a new file called ~/.api_profile:
nano ~/.api_profile
Add this line:
export ANTHROPIC_API_KEY=sk-ant-your-key-here
Save and exit.
Step 3: Use it only when needed
When you need to run a script that uses the API, activate the API key in that terminal session:
source ~/.api_profile
./your-script.py
This sets the API key only for that terminal window. When you close it or open a new terminal, the API key won't be set, so Claude Code will use your subscription.
If you do use an API key, configure spending limits in your Anthropic API settings to prevent unexpected charges.
Give Vroni a GitHub issue, bug report, spec, or rough idea. It reads the repo, plans the change, writes code, runs checks, and works toward a review-ready pull request.
Take a look at vroni.com