Can a Coding Harness Get Your Account Banned? Credential Custody, Explained

Published August 21, 2026 · by the AQ team

Yes, it has happened: in January 2026, developers using third-party coding tools signed in with Claude Pro and Max subscriptions had accounts banned by Anthropic's abuse filters, and Anthropic then blocked that authentication path entirely. Whether your setup carries that risk comes down to one question: whose credentials does your harness hold, and does the model provider allow that credential to be used there? This guide explains the custody patterns, what each provider's rules say as of August 2026, and how to run agents so the question never lands on your account.

The question behind the question: whose credential is it?

Every coding agent authenticates to a model provider somehow, and the ban risk lives almost entirely in which of three custody patterns your tool uses:

• The vendor's own CLI, your own login. Claude Code signed in to your Claude plan, Codex CLI signed in to your ChatGPT plan. The provider built the tool, the login flow, and the plan together. This is the pattern the subscriptions are sold for.
• A third-party tool reusing your subscription login. The tool obtains or borrows the OAuth token from your consumer plan and calls the provider's API with it, from software the provider did not build. Whether this is permitted differs sharply by provider, and this is where the 2026 bans happened.
• A third-party tool with your API key. You mint a key in the provider's developer console and pay published per-token rates. This is the path providers tell developers to build on, and tools like Aider, Cline, and OpenCode all support it.

Note what is not on this list: the harness itself. OpenCode, Cline, and Roo Code are capable tools, and none of them is inherently risky. The risk is a property of the credential path, not the software: the same harness can be fully supported on one path (an API key, or a Codex login) and a terms violation on another (a Claude subscription token), which is exactly how 2026 played out.

What happened in January 2026

Several popular third-party harnesses had been offering a "log in with Claude" flow that reused consumer-plan OAuth tokens, in some cases sending headers that made the traffic look like the official Claude Code client. For users the appeal was obvious: agentic workloads on a flat monthly plan instead of metered API pricing.

On January 9, 2026, Anthropic deployed server-side checks that rejected those tokens outside its own clients. Tools including OpenCode, Cline, and Roo Code stopped working with subscription logins overnight, returning an error that the credential "is only authorized for use with Claude Code." An Anthropic engineer explained on X that the safeguards were tightened after user accounts were banned for triggering abuse filters from third-party harnesses using Claude subscriptions, and the company said bans applied in error were being reversed.

The sequence matters for anyone weighing the risk today: automated abuse systems fired on unusual traffic first, and the policy enforcement followed. If your credentials flow through a path the provider considers unauthorized, the thing that acts on it may be an abuse filter with no advance notice, and reinstatement depends on an appeals queue you cannot schedule.

What the rules say, provider by provider

Anthropic's position is now explicit in its Claude Code legal and compliance documentation. As of August 2026: OAuth authentication "is intended exclusively for purchasers of Claude Free, Pro, Max, Team, and Enterprise subscription plans and is designed to support ordinary use of Claude Code and other native Anthropic applications." Developers building products that interact with Claude, including through the Agent SDK, "should use API key authentication," and "Anthropic does not permit third-party developers to offer Claude.ai login or to route requests through Free, Pro, or Max plan credentials on behalf of their users." The same page notes that advertised Pro and Max limits assume ordinary, individual usage, and that Anthropic "may take measures to enforce these restrictions and may do so without prior notice."

OpenAI has taken a more permissive posture on the same question. Codex is included across ChatGPT plans via a sign-in flow, and as of August 2026 that flow works inside third-party tools: OpenCode shipped ChatGPT-plan authentication in January 2026 using the same official method as Codex CLI, and OpenAI's own Codex for Open Source program describes maintainers using Codex through third-party tools by name. The community plugins that wire this up describe it as intended for personal development use rather than resale or multi-user services. A more open policy is not immunity, though: OpenAI's automated systems deactivate accounts for terms violations with an email and an appeal link, and developer-community threads through 2026 document Pro subscribers deactivated mid-session with appeals that take weeks or receive no human response.

The risk ladder

Setups ordered from safest to most exposed, as of August 2026:

Two patterns deserve a flag because teams drift into them innocently. A shared org login (one Claude or ChatGPT account for five engineers) concentrates all usage on one identity, which exhausts per-person limits and looks like exactly the anomaly abuse systems hunt; per-user accounts fix both. And any tool that asks you to paste a session token extracted from a browser, rather than completing the provider's own login or key flow, is putting your account on the wrong side of the ladder.

If your account gets banned anyway

• Use the official appeal path once, precisely. For OpenAI, the link in the deactivation email or the appeal form, including your user and org IDs and a factual description of your setup. For Anthropic, the support flow on the ban notice. Duplicate appeals reportedly do not help.
• Do not create a replacement account. Ban evasion is its own violation on both providers and can convert a recoverable mistake into a permanent one.
• Move the workload to a clean path while you wait. An API key in the same tool keeps you working at metered rates without touching the suspended subscription.
• Fix the path that caused it. Reinstatement into the same setup reproduces the same flags.

How teams stay off the radar entirely

The configuration that survives policy changes like January's is boring: every engineer signs the vendor's own CLIs in as themselves, automation uses scoped API keys, and nothing in between holds, proxies, or rewrites anyone's credentials. That gives each provider the traffic shape it expects (one human, one plan, its own client) and keeps billing on your own accounts. It also composes with running agents on a server: the custody question is about which software holds the credential, not which machine it runs on, and the vendor CLIs run fine on a VM you own.

Where AQ fits

AQ is the multiplayer coding harness where engineering teams run AI coding agents like Claude Code and Codex together: shared live terminals, a code editor, and app previews, in your own cloud. In this guide's terms, AQ is built on the first rung of the ladder by construction. Agents run as the real vendor CLIs (Claude Code, Codex, Cursor Agent, Kimi, Grok, or plain shells) in persistent tmux sessions on your team's VM, and each engineer signs those CLIs in with their own Claude or OpenAI account, exactly as they would on a laptop. AQ never marks up model usage, and there is no shared multi-tenant execution tier: your agents, your VM, your logins.

That design choice is why the January 2026 enforcement was a news story for AQ users rather than an outage: nothing in the stack reuses subscription OAuth outside the vendors' own clients, so there was nothing to block. The team layer sits around the CLIs (sessions that survive a closed laptop, teammates watching the same live terminal, per-user GitHub auth and isolated worktrees), not between the CLIs and the model providers.

Plainly: if you are one engineer running Claude Code and Codex under your own logins, you already have the safe pattern, and you do not need AQ for it. AQ earns its place when a team wants that same clean-custody setup shared, persistent, and visible without building the glue. The Free plan is a personal sandbox AQ creates for you, no time limit; the Team plan is $50 per user per month in early access (standard $200), on VMs you connect from your own cloud or a dedicated AQ-managed VM.