{"slug": "claude-code-s-default-telemetry-sends-anthropic-sha-256-hashes-of-files-it-reads", "title": "Claude Code's default telemetry sends Anthropic SHA-256 hashes of files it reads", "summary": "Claude Code version 2.1.312, the newest release as of an October 27, 2026 retest, still sent Anthropic an unsalted SHA-256 hash of every file the agent read, alongside a device ID and session ID, even when pointed at a DeepSeek model with no Anthropic account signed in, according to a researcher who reported the behavior to privacy@anthropic.com on September 26, 2026 and received only an automated acknowledgement. The researcher recovered a password from a fake .env file in three and a half seconds by checking guesses against the fingerprint offline, rated the finding Medium because file contents never leave the machine and a properly random API key cannot be recovered this way, and confirmed that setting CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 produced zero telemetry in opt-out runs. The same fingerprint was observed on builds 2.1.283 in September 2026 and 2.1.303 on October 19, 2026, with a 2.1.286 control reproducing the result in each batch.", "body_md": "# Claude Code tells Anthropic which files it reads, even when you use someone else's model\n\n## A model cannot phone home. Its harness can.\n\nPoint Claude Code at another company's model, don't log in to Anthropic at all, and it still sends Anthropic a fingerprint of the files it reads. We caught it doing exactly that on 19 October on version 2.1.303, and again on 27 October on version 2.1.312, the newest release at the time of that retest, with a DeepSeek model doing the work and no Anthropic account anywhere in the setup. In September, signed in on a Max plan, it did the same and also sent the git commit of the repository.\n\nThe fingerprint is an unsalted SHA-256 of the file's full contents, sent next to a device ID and a session ID. It isn't the file, and Anthropic would be right to say so, but it is far from harmless. If you know most of what is in a file, and for a .env built from a template you usually do, anyone holding that telemetry can guess the one secret in it and check each guess against the fingerprint offline. We tried it on a fake .env and had the password back in three and a half seconds.\n\nWe told Anthropic on 26 September and got an automated acknowledgement, nothing more. Three weeks later it was still happening. You can stop it today: set `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1`. We rate it Medium: no file contents leave your machine, and a properly random API key cannot be recovered this way. A weak password can.\n\n## What we captured, and what we captured most recently.\n\nOriginal capture, September 2026, Claude Code **2.1.283**, Max account, default settings: a telemetry event to\n  `api.anthropic.com` whose `contentHash` equalled `sha256` of the file the agent had read, sent alongside the\n  device and session ids.\n\nEarlier retest, **19 October 2026 on build 2.1.303**: the fingerprint was **still present**. Three POSTs returned 200, and the 64-hex `contentHash` matched `sha256sum` of the file read, on the same event that carried `device_id` and `session_id`. A 2.1.286 control run produced the same result, so the measurement itself is working.\n\nRetest, **27 October 2026 on build 2.1.312**, the latest release at that retest: **still present**. Four telemetry POSTs to `api.anthropic.com` returned 200, one file-operation event carried the matching `contentHash`, and the 64-hex `contentHash` again matched `sha256sum` of the file read, with `device_id` and `session_id` on the same event. The 2.1.286 control reproduced it in the same batch, and both opt-out runs sent **zero** telemetry.\n\n## A fingerprint, not the file.\n\nThe file's contents are **not** transmitted. A fingerprint is still identifying: a file we know can be recognised from it, and a\n  guessed short secret can be checked against it. That is why we treat it as a privacy finding rather than a curiosity.\n\n## One setting turns it off, and we tested that it does.\n\nSetting `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1` together with the `DISABLE_*` variables produced no telemetry in our tests. The opt-out works.\n\n## What this note does not claim.\n\n- **head_sha was not retested.** The original logged-in run showed the git commit id in telemetry. The retest rig workspace is not a git\n    repository, so that part stands on the September capture and the string's presence in the binary, not on a fresh observation.\n- **The signed-in state was not retested.** We did not retest the signed-in state.\n- **One unit per condition.** That is corroboration, not proof. It is consistent across 2.1.283, 2.1.286, 2.1.303 and 2.1.312.\n- We do not claim 2.1.312 is still the newest release today, or that nothing changed after it. 2.1.312 was the newest release when we retested on 27 October 2026, and we report what that build did.\n\n## Reported, then published.\n\n26 September 2026: report sent to `privacy@anthropic.com`. An automated acknowledgement came back the same day; no substantive reply is\n  recorded by us, and nothing in this note should be read as a vendor statement. 19 October 2026: retest on build 2.1.303. 27 October 2026: retest on build 2.1.312, the newest release at that time. 28 October 2026: published.", "url": "https://wpnews.pro/news/claude-code-s-default-telemetry-sends-anthropic-sha-256-hashes-of-files-it-reads", "canonical_source": "https://agenticbench.org/ant-1-claude-code-telemetry.html", "published_at": "2026-10-28 09:28:30+00:00", "updated_at": "2026-10-28 09:42:39.764755+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "ai-agents", "developer-tools"], "entities": ["Anthropic", "Claude Code", "DeepSeek", "privacy@anthropic.com"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/claude-code-s-default-telemetry-sends-anthropic-sha-256-hashes-of-files-it-reads", "markdown": "https://wpnews.pro/news/claude-code-s-default-telemetry-sends-anthropic-sha-256-hashes-of-files-it-reads.md", "text": "https://wpnews.pro/news/claude-code-s-default-telemetry-sends-anthropic-sha-256-hashes-of-files-it-reads.txt", "jsonld": "https://wpnews.pro/news/claude-code-s-default-telemetry-sends-anthropic-sha-256-hashes-of-files-it-reads.jsonld"}}