Codex Security Plugin - Weekly usage limit dropped from ~75% to 16% in 19 minutes despite only 98,700 total tokens reported

What issue are you seeing?

I believe there is an issue with the weekly usage calculation in Codex.

I am currently on the 5x plan. At the beginning of this Codex session I had around 75% of my weekly usage remaining. After only 19 minutes and 36 seconds, my remaining weekly usage had dropped to approximately 16%.

The strange part is that Codex reported the following token usage for the entire session:

Token usage: total = 9 8,700 input = 92,869 (+ 1,229,952 cached) output = 5,831 (reasoning 1,562)

So within roughly 19 minutes, about 59 percentage points of my weekly limit were consumed, while the CLI itself reports only 98,700 total tokens.

The task being executed was a security audit using the deep scan coordinator. The output also stated that the audit was still running and that the deep scan coordinator had not yet returned its findings. According to the message, the deep scan has a default time budget that can reach 96 hours.

I understand that there are also 1,229,952 cached input tokens shown in the output, but it is unclear whether those are counted against the weekly limit, how they are counted, or whether usage from the deep scan coordinator and its agents is missing from the displayed total value.

If deep scan agents, subagents, cached context, or background processes consume additional weekly usage, that usage should be visible somewhere. Right now the numbers shown by Codex do not appear to explain how my remaining weekly usage could drop from around 75% to 16% in less than 20 minutes.

What steps can reproduce the bug?

Run the Codex Security Plugin on Astra 6 - Medium.

What is the expected behavior?

No response

Additional information

No response

No source file or test is named. Start by reproducing the issue with the Codex Security Plugin on Astra 6 - Medium, then compare the CLI's displayed totals with the weekly usage change, including cached tokens and deep scan activity. Done means the discrepancy is explained and all relevant usage is represented consistently.