Claude Code has a billing bug: if your git repo's commit history contains the uppercase string HERMES.md, every API request bypasses your Max subscription quota and gets charged from extra usage. One Max 20x subscriber — who pays $200 a month — got quietly dinged $200.98 in extra usage, despite having used only 13% of their quota.
The trigger is absurdly specific. It has to be uppercase HERMES.md, case-sensitive, with the .md suffix. Lowercase hermes.md? Safe. No suffix (HERMES)? Safe. HERMES.txt? Also safe. The bug isn't about whether the file exists on disk — it's that Claude Code feeds git log commit messages into its system prompt, and Anthropic's server-side anti-abuse system does string matching on that text. HERMES is a configuration file name from Nous Research's open-source AI agent framework Hermes Agent. The anti-abuse system was likely looking for non-official API clients, but instead it nailed every legitimate user unlucky enough to have that string in a commit message.
The reporter spent hours with binary search debugging: cloning repos, testing isolated branches, narrowing down commits, until they landed on the trigger string. Another user independently reproduced it and wrote an automated script. Claude Code lead Boris Cherny confirmed it was an "overactive anti-abuse system" and fixed it the same day.
But the refund part went off the rails. The user filed a request, and Anthropic's AI support replied that it "cannot provide compensation for downgrade service or billing routing technical errors." Straight-up denial. That response blew up on GitHub and Hacker News, making the front page. The community wasn't just mad about $200 — the anti-abuse system shouldn't have disguised a false positive as a quota exhaustion error, and especially shouldn't have refused a refund after admitting the bug. Claude Code team member Thariq later announced that all affected users would get a full refund plus an equal credit on top.
The incident comes as Anthropic's Claude models face increasing competition — rival Kimi K2.6 recently overtook Claude in token consumption on OpenRouter.