Claude Code tells Anthropic which files it reads, even when you use someone else's model

A model cannot phone home. Its harness can.

Point Claude Code at another company's model, don't log in to Anthropic at all, and it still sends Anthropic a fingerprint of the files it reads. We caught it doing exactly that on 19 October, on version 2.1.303, with a DeepSeek model doing the work and no Anthropic account anywhere in the setup. In September, signed in on a Max plan, it did the same and also sent the git commit of the repository.

The fingerprint is an unsalted SHA-256 of the file's full contents, sent next to a device ID and a session ID. It isn't the file, and Anthropic would be right to say so, but it is far from harmless. If you know most of what is in a file, and for a .env built from a template you usually do, anyone holding that telemetry can guess the one secret in it and check each guess against the fingerprint offline. We tried it on a fake .env and had the password back in three and a half seconds.

We told Anthropic on 26 September and got an automated acknowledgement, nothing more. Three weeks later it was still happening. You can stop it today: set CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1. We rate it Medium: no file contents leave your machine, and a properly random API key cannot be recovered this way. A weak password can.

What we captured, and what we captured most recently.

Original capture, September 2026, Claude Code 2.1.283, Max account, default settings: a telemetry event to api.anthropic.com whose contentHash equalled sha256 of the file the agent had read, sent alongside the device and session ids.

Retest, 19 October 2026 on build 2.1.303: the fingerprint is still present. Three POSTs returned 200, and the 64-hex contentHash matched sha256sum of the file read, on the same event that carried device_id and session_id. A 2.1.286 control run produced the same result, so the measurement itself is working.

A fingerprint, not the file.

The file's contents are not transmitted. A fingerprint is still identifying: a file we know can be recognised from it, and a guessed short secret can be checked against it. That is why we treat it as a privacy finding rather than a curiosity.

One setting turns it off, and we tested that it does.

Setting CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 together with the DISABLE_* variables produced no telemetry in our tests. The opt-out works.

What this note does not claim.

• head_sha was not retested. The original logged-in run showed the git commit id in telemetry. The retest rig workspace is not a git repository, so that part stands on the September capture and the string's presence in the binary, not on a fresh observation.
• The signed-in state was not retested. We did not retest the signed-in state.
• One unit per condition. That is corroboration, not proof. It is consistent across 2.1.283, 2.1.286 and 2.1.303.
• We do not claim this is the newest Claude Code release, or that nothing changed after 2.1.303. We retested one build and report what it did.

Reported, then published.

26 September 2026: report sent to privacy@anthropic.com. An automated acknowledgement came back the same day; no substantive reply is recorded by us, and nothing in this note should be read as a vendor statement. 19 October 2026: retest on build 2.1.303. 28 October 2026: published.