Claude Code Session Efficiency: What Cost Optimization Does to Your Audit Trail

Anthropic published a guide to Claude Code session efficiency on August 14, 2026: "Maximizing the value of your Claude Code sessions", by Lydia Hallie. It is cost guidance: no CVE, no vulnerability, no incident, no security claim - and on the engineering merits it is right.

Claude Code session efficiency and session forensics pull on the same rope. Every practice in the guide changes what sits in the model's context while work happens: /clear and /compact reset or rewrite the working buffer, a subagent does the noisy work elsewhere and returns only its answer, MAX_THINKING_TOKENS=0 drops the reasoning trace, and CLAUDE.md carries a team's daily commands with the repository. The mechanism is in how Claude Code works for security teams.

None of that is a flaw in the advice. It is the reason an audit trail cannot live inside the session.

What Anthropic actually published on August 14, 2026

The framing is not a request to use Claude Code less:

Being efficient with tokens doesn't mean using fewer of them overall. It means making sure the ones you do use go towards the thing you actually asked for.Anthropic, "Maximizing the value of your Claude Code sessions", August 14, 2026

The TL;DR is six bullets, every one a habit worth having:

• Run /clear between tasks.
• Set model and effort level before you start.
• @-mention files instead of naming them.
• Add quiet flags to noisy commands, or run them in a subagent.
• Run /context once in a fresh session.
• /compact before you take a break from your keyboard.

Our Claude Code commands cheat sheet covers /clear, /compact, /rewind, /context, /model, /effort and /mcp. Caching, compaction, rewind and subagents are all longstanding behavior, so this consolidates cost guidance rather than announcing a feature. The per-developer spend figures that circulate alongside it are Anthropic's own and live in the Claude Code cost documentation, not in this post: around $13 per developer per active day, $150-250 per developer per month, and below $30 per active day for 90% of users.

Why Claude Code session efficiency is really context management

Three things decide the price of a token: which model runs, whether it is input (prefill) or output (decode), and whether it was cached. Output costs roughly 5x input; cache reads cost 0.1x input and writes up to 2x, but a write happens once while the cheap reads happen every turn after. The line that matters for forensics is about accumulation: "nothing gets sent just once. Everything that ends up in the conversation, a file Claude read or the output of a command it ran, gets sent again on every turn after it, for the rest of the session."

So cost scales with what is in the buffer, and every efficiency lever is a lever on the buffer. The cache matches an exact prefix - tool definitions, system prompt, then the conversation with CLAUDE.md at its front - so /model, /effort, fast mode, /compact and elapsed time all throw it away. Expiry is an hour on a subscription and five minutes on an API key, and per the documentation five minutes for subagents, forks and compaction even on a subscription.

The post ends with "Where to look first", published as a graphic rather than body text. Its four labels, in Anthropic's order, and what each one does to the session:

• 1. Long sessions - "every turn re-sends everything before it". Pressure toward shorter sessions: more resets, more boundaries to stitch across.
• 2. Too much in the context - noisy command output and "leftovers from the previous task" get re-sent every turn. That output is what a forensic record wants most.
• 3. A bigger model or higher effort level than the task needs - "both settings stick between sessions", and effort is part of the cache key, not the prompt text.
• 4. Breaking the prompt cache - changing model, effort or fast mode mid-conversation "prefills the whole conversation again at full price".

Read as an architecture document rather than a cost one, that list says spend is minimized by keeping the working buffer small, fresh and stable. Correct engineering, and exactly why the buffer is a poor place to keep evidence. The broader version is in the Claude Code harness as an attack surface: the session belongs to the tool, not to your governance program.

What /clear and /compact actually reset

The intuitive reading of /clear - that it wipes the session - is wrong. Per Claude Code documentation, sessions "are saved continuously to local transcript files as you work, so you can return to one after exiting or running /clear", and /clear "saves the previous conversation; resume it with /resume". It resets the in-context working buffer, not the file on disk.

/compact rewrites rather than resets, and does not preserve a session evenly. Per the documentation, project-root CLAUDE.md, unscoped rules, auto memory and the plan-mode plan are re-injected from disk; files Claude read or edited come back as "up to five, most recently modified first"; skill bodies are capped at 5,000 tokens each and 25,000 in total; and "Context that hooks added earlier" is summarized away. Those priorities exist to make the next turn work. /rewind is the better small rollback: cheaper, and a truncation to a known prefix.

So if your record is the conversation, compaction is a retention policy written by a summarizer. That is why tool calls alone are not an audit trail, and why our CISO guide to auditing AI agent activity starts from an out-of-band event stream keyed to real actions instead.

Subagents move the noisiest work out of the main transcript

The advice for noisy jobs is to run them in a subagent, and the boundary is described precisely:

A subagent gets its own context window, with its own system prompt, the tools, and your CLAUDE.md, but not your conversation. It runs its own turns, and the only thing that comes back to the main session is its answer. Everything else is thrown away once it's done.Anthropic, August 14, 2026

The post adds its own caveat: "the main session only gets back what the subagent chose to report." That is not a claim that subagent activity is invisible. Per Claude Code documentation the subagent's call and its returned result append to the parent conversation; what does not come back are its own intermediate turns - tool calls, file reads, command output. Subagents are also where high-privilege work lands, because that is the work that is noisy.

So the investigator's sentence is: a subagent was asked to do X and reported Y. Whether it read six files or sixty is a question for something outside the conversation - the fleet-side artifacts in auditing Claude Code across a fleet, which persist on the endpoint whatever a session kept. Systima's controlled benchmark "The Subagent Tax", July 22, 2026, measured fan-outs at 2.6x to 5.9x the input tokens of the same task run sequentially. That is a cost result rather than a security one, and it cuts the same way here: a fan-out multiplies exactly the turns the main transcript never keeps.

The settings that persist, and the reasoning trace that does not

Two levers change what a session is without appearing inside it. /model and /effort both persist into the next session - "the level you pick with /effort sticks around as your default" - and neither is part of the prompt text, so a session that ran on a different model than anyone assumes does not say so in the conversation. A third, MAX_THINKING_TOKENS=0, is scoped by Anthropic to one session of "grunt work" and does not apply on Fable 5. Take it as a reminder rather than a warning: a reasoning trace is a model output an environment variable removes, so an incident process that depends on reading an agent's stated reasoning was never resting on a control. The pattern is not confined to Anthropic's guide: the settings that decide how an agent behaves keep moving out of the conversation and into the environment around it, and new Claude Code features in 2026 and their security implications tracks the ones a security team has to know about.

CLAUDE.md is a config surface that travels with the repository

The context advice pushes work into files: put the two or three commands you run every day into CLAUDE.md with the quiet flags in them (npx vitest run <file> --reporter=dot is the worked example), use the documented hook that rewrites noisy commands before they run, and keep "CLAUDE.md to specific instructions and move workflow-specific ones into skills, which only get loaded when they're used".

Be precise about the mechanism. CLAUDE.md is not executed and does not run commands; it is instruction text the model may act on, and hooks are the executable surface. But it is committed to a repository, so the commands a team's agents habitually run arrive with a clone or a pull request - and it is read once at session start, so a mid-session edit does not apply until the next /clear, /compact or restart. That surface is already attacked: the Shai-Hulud "here we go again" npm worm planted Claude Code hooks across at least 868 packages by Aikido's count, with OX Security reporting 440+ and SafeDep 1,684 poisoned versions across 420 package names - every published figure is a floor - and AWS Kiro rewrote its own mcp.json from hidden text on a web page. What we find scanning AI agent configs is the base rate.

Moving instructions into skills relocates that surface onto the endpoint rather than removing it. The control that does not depend on operator discipline is managed settings - see deploying Claude Code across a fleet.

The transcript was never the audit trail

Which records of a Claude Code session exist, and who controls each:

Two things follow. The local transcript is a real record and a bad chain of custody: Anthropic warns its format "is internal to Claude Code and changes between versions", and all three sit in the operator's own settings - one sets retention, one moves the store, one suppresses the writes. The Compliance API is the genuine out-of-band answer for what it covers - announced August 11, 2026, generally available August 26 - but it needs Claude Enterprise, and the beta announcement scoped it out of Claude Code on the web, the Claude Platform, and Bedrock, Vertex AI or Microsoft Foundry sessions, which the GA note does not restate. Auditing AI chat and streaming interactions covers that record in depth.

The third route is documented and rarely deployed: hooks receive a transcript_path, and SessionEnd hooks run when a session ends, for cleanup and logging - enough to archive the transcript yourself, at a boundary the conversation does not own. It is worth something only when pushed as a managed setting, and it has to fit the 1.5-second default budget every SessionEnd hook shares. See how Claude Code hooks work and how permissions actually work.

What Claude Code session efficiency changes for an investigator

Four questions an incident lead asks, and where each answer now lives:

• What did the agent run? Not reliably in the conversation. Output over 30,000 characters goes to a file with only a preview left inline (BASH_MAX_OUTPUT_LENGTH), quiet flags trim the rest by design, and a subagent returns its answer rather than its turns.
• Which files did it touch? After a compaction, up to five, most recently modified first. @-mentioning changes nothing: it removes the Read call, and "the file itself takes up the same room in the context either way".
• Under what settings? Model, effort and thinking budget are not in the prompt text, and model and effort persist across sessions as defaults.
• What changed on the machine? With MCP tool definitions deferred by default on supported models, a server connecting or disconnecting only appends content and does not disturb what is cached. Where tools do load into the prefix instead, a mid-session connect or disconnect is the most common cause of an invalidation.

Every answer is endpoint state or an event at a boundary, which is why behavioral baselines built from observed endpoint activity hold where transcript reading does not, and why "we will read the session back" is not a plan. See the AI agent incident response playbook and securing AI coding agents and CLIs.

How Anomity keeps the record when the session does not

The workflow is deliberately independent of what any session kept:

1. Inventory the artifacts, not the conversation. An unprivileged Endpoint Sensor for Windows, macOS and Linux inventories eight AI artifact types per endpoint: AI agents, MCP servers, extensions, plugins, skills, secrets, hooks, and CLIs. CLAUDE.md, hook definitions and MCP config are files on a machine, so /clear does nothing to them. See what Anomity covers.
2. Decide at the hook. Where an agent exposes one - Claude Code's PreToolUse is the concrete case - Anomity returns allow, deny or log before the call runs, and records that decision whether the call came from the main session or a subagent.
3. Keep a trail that outlives the session. A queryable 90-day audit trail of every AI artifact added, changed or removed, plus those hook decisions, routed to your SIEM, Slack, email or Jira. Queryable includes from inside the assistant: the Anomity MCP server exposes that trail read-only, so an investigator can ask what changed and when without the conversation being the record.

Two honest limits. Anomity is metadata only: no prompts, responses or reasoning captured, and secrets redacted on the endpoint, so it is not a substitute for the Compliance API when you need conversation content. And there is no enforcement where an agent exposes no hook, and no visibility inside a vendor's cloud. SOC 2 Type II, and it complements Network, EDR, DLP and GRC rather than replacing them.

Where this leaves you

Follow Anthropic's advice: /clear between tasks, keep the context small, put the quiet flags in CLAUDE.md, push noisy jobs into a subagent. Then stop treating what is left inside the session as the record of what happened, because the logic of the guidance is that a cheap session is a small one. Decide where your out-of-band record lives - a SessionEnd archive as a managed setting, the Compliance API where it reaches, an endpoint-side artifact and hook-decision trail for the rest - before an investigator has to ask. Book a demo if you want that record on your fleet.

Related

• New Claude Code features in 2026 and their security implications
• Configuring Claude Code permissions and hooks
• Governing AI coding assistants across your fleet
• Claude security and where scan-time vetting ends
• What are AI agent skills? A security primer
• Claude Code commands cheat sheet