---
title: Anthropic Extra Usage Spend Limit Deleted
description: Extra usage spend limits cap Anthropic organizational spend beyond included usage. Deleting a spend limit removes that cap and can enable unrestricted...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/impact_anthropic_extra_usage_spend_limit_deleted
products:
  - Elastic Security
---

# Anthropic Extra Usage Spend Limit Deleted
Extra usage spend limits cap Anthropic organizational spend beyond included usage. Deleting a spend limit removes that
cap and can enable unrestricted API or Claude consumption. An attacker who already has administrative or API access can
delete the limit to burn budget, run large automated workloads, or stage resource abuse without the previous guardrail.
**Rule type**: esql
**Rule indices**:
**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://platform.claude.com/docs/en/api/compliance/activities/list](https://platform.claude.com/docs/en/api/compliance/activities/list)](https://platform.claude.com/docs/en/api/compliance/activities/list)

**Tags**:
- Domain: GenAI
- Platform: Anthropic
- Data Source: Anthropic Audit Logs
- Use Case: Threat Detection
- Resources: Investigation Guide
- Rule Type: ES|QL
- Tactic: Impact
- Mitre Atlas: AML.T0034

**Version**: 1
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Investigation guide


## Triage and analysis


### Investigating Anthropic Extra Usage Spend Limit Deleted

Deleting an extra-usage spend limit removes a billing guardrail; it does not create spend by itself. Treat it as an
early signal for follow-on quota burn or automated workloads.
Unauthorized = no finance/platform ticket to redesign billing, and no nearby `extra_usage_spend_limit_created` /
`extra_usage_spend_limit_updated` that replaces the deleted limit — especially if high chat creation or file uploads
follow.

#### Possible investigation steps

- Branch on actor: `user_actor` → `user.email` / `source.ip` / UA; `api_actor` → `anthropic.audit.actor.api_key_id`
  and whether that key is in inventory.
- Check for create/update of a replacement limit within the same change window (planned redesign) vs standalone
  deletion.
- After the delete, look for elevated `claude_chat_created`, file uploads, or other high-volume activity on the same
  `organization.id`.
- Close as FP when a finance/platform ticket names the redesign and a replacement create/update exists. Escalate when
  deletion is orphaned or usage spikes afterward.


### False positive analysis

- Billing consolidations often delete an old limit shortly before creating a new one.


### Response and remediation

- On unauthorized deletion: restore an appropriate spend limit, review API keys and admin sessions active during the
  exposure window, and quantify extra usage accrued after the change.


## Rule Query

```esql
from logs-anthropic.audit-* metadata _id, _version, _index
| where
    data_stream.dataset == "anthropic.audit" and
    mv_contains(event.category, "configuration") and
    event.action == "extra_usage_spend_limit_deleted"
| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Impact
  - Id: TA0040
  - Reference URL: [[https://attack.mitre.org/tactics/TA0040/](https://attack.mitre.org/tactics/TA0040/)](https://attack.mitre.org/tactics/TA0040/)
- Technique:
  - Name: Resource Hijacking
  - Id: T1496
  - Reference URL: [[https://attack.mitre.org/techniques/T1496/](https://attack.mitre.org/techniques/T1496/)](https://attack.mitre.org/techniques/T1496/)