A model cannot phone home. Its harness can. #
Point Claude Code at another company's model, don't log in to Anthropic at all, and it still sends Anthropic a fingerprint of the files it reads. We caught it doing exactly that on 19 October on version 2.1.303, and again on 27 October on version 2.1.312, the newest release at the time of that retest, with a DeepSeek model doing the work and no Anthropic account anywhere in the setup. In September, signed in on a Max plan, it did the same and also sent the git commit of the repository.
The fingerprint is an unsalted SHA-256 of the file's full contents, sent next to a device ID and a session ID. It isn't the file, and Anthropic would be right to say so, but it is far from harmless. If you know most of what is in a file, and for a .env built from a template you usually do, anyone holding that telemetry can guess the one secret in it and check each guess against the fingerprint offline. We tried it on a fake .env and had the password back in three and a half seconds.
We told Anthropic on 26 September and got an automated acknowledgement, nothing more. Three weeks later it was still happening. You can stop it today: set CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1. We rate it Medium: no file contents leave your machine, and a properly random API key cannot be recovered this way. A weak password can.
What we captured, and what we captured most recently. #
Original capture, September 2026, Claude Code 2.1.283, Max account, default settings: a telemetry event to
api.anthropic.com whose contentHash equalled sha256 of the file the agent had read, sent alongside the
device and session ids.
Earlier retest, 19 October 2026 on build 2.1.303: the fingerprint was still present. Three POSTs returned 200, and the 64-hex contentHash matched sha256sum of the file read, on the same event that carried device_id and session_id. A 2.1.286 control run produced the same result, so the measurement itself is working.
Retest, 27 October 2026 on build 2.1.312, the latest release at that retest: still present. Four telemetry POSTs to api.anthropic.com returned 200, one file-operation event carried the matching contentHash, and the 64-hex contentHash again matched sha256sum of the file read, with device_id and session_id on the same event. The 2.1.286 control reproduced it in the same batch, and both opt-out runs sent zero telemetry.
A fingerprint, not the file. #
The file's contents are not transmitted. A fingerprint is still identifying: a file we know can be recognised from it, and a guessed short secret can be checked against it. That is why we treat it as a privacy finding rather than a curiosity.
One setting turns it off, and we tested that it does. #
Setting CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 together with the DISABLE_* variables produced no telemetry in our tests. The opt-out works.
What this note does not claim. #
- head_sha was not retested. The original logged-in run showed the git commit id in telemetry. The retest rig workspace is not a git repository, so that part stands on the September capture and the string's presence in the binary, not on a fresh observation.
- The signed-in state was not retested. We did not retest the signed-in state.
- One unit per condition. That is corroboration, not proof. It is consistent across 2.1.283, 2.1.286, 2.1.303 and 2.1.312.
- We do not claim 2.1.312 is still the newest release today, or that nothing changed after it. 2.1.312 was the newest release when we retested on 27 October 2026, and we report what that build did.
Reported, then published. #
26 September 2026: report sent to privacy@anthropic.com. An automated acknowledgement came back the same day; no substantive reply is
recorded by us, and nothing in this note should be read as a vendor statement. 19 October 2026: retest on build 2.1.303. 27 October 2026: retest on build 2.1.312, the newest release at that time. 28 October 2026: published.