When a safety classifier flags a request, Claude Code can hand the rest of the session to an older model. Watch it happen in 115 real sessions from VulcanBench, then print a receipt for your own.
Each line is one Claude Code session, left to right. Click a line to replay it above.
Max effort cost 3 times as much per task as medium, took twice as long, and passed fewer tasks: 21 of 23 against 23 of 23.
of the money spent at max effort went to Opus 4.8. In 12 of 23 max sessions the classifier stepped in, mostly in the first fifth of the session, and Opus 4.8 did the rest.
failed tasks at high, extra high and max had a safety classifier step in. The 6 failures at low effort were Opus 5.5 on its own.
Read this before you share it. All 30 handoffs were in the cyber category. These tasks rebuild old binaries, which looks a lot like reverse engineering, so ordinary coding may never trigger it. Each task ran once per level, so a gap of 2 tasks is within noise. The receipt below tells you what happens in your own sessions.
One Python file, no installs. It reads the logs Claude Code and Codex already keep on your computer.
Download it from GitHub, or clone the repo.
curl -O https://raw.githubusercontent.com/guoziyu415/model-receipt/main/model_receipt.pyIt prints a receipt in your terminal and saves model-receipt.json next to it.
python3 model_receipt.pyRun view to open this page with your data, or drop model-receipt.json on the scene above. The file is read in your browser and never uploaded.
python3 model_receipt.py viewWhat it reads: model names, reply counts, effort level, output token counts, timestamps and project folder names. What it never reads: your prompts, code or replies. It changes nothing and sends nothing. Use --anonymize to hide project names before you share the file.
Codex: OpenAI also routes some high risk cyber requests to a less capable model. But Codex logs only the model you picked for each turn, not the one that answered, so the receipt can list your Codex models but cannot catch a reroute.