Hey, thanks for the report. This isn’t a billing bug or someone else accessing your account. Here’s what happened.
When you run an agent, in your case Grok 4.5 via the CLI, it can spin up a helper subagent using the Task tool. Right now the subagent doesn’t always inherit the parent model, and the parent agent may pick a different model for it from the allowlist. In your case, Grok picked Sonnet 5 for a subtask. That’s why you see Sonnet 5 in Spending even though you didn’t select it manually.
Important: this usage was within the included Pro quota (usage_type=included), so it wasn’t a separate on-demand charge.
This is known behavior. The team is tracking it and working on making subagents follow the selected model more reliably. I can’t share an ETA for a fix yet. The same issue is discussed here: Subagent Ignores Configured Composer 2.5 Model and Switches to Sonnet 5 High
If you want to reduce this for now, you can explicitly tell the agent in your prompt to use your chosen model for subagents too. Let me know if anything else in the usage looks off.