Claude Code's default telemetry sends Anthropic SHA-256 hashes of files it reads
Comments on “Claude Code's default telemetry sends Anthropic SHA-256 hashes of files it reads”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
AgenticBench reports that Claude Code, including build 2.1.312 on 27 October, sends api.anthropic.com an unsalted SHA-256 hash of each file it reads, with device and session IDs, even with a DeepSeek model and no Anthropic login. Weak secrets in templated files such as .env can be guessed and checked offline; the authors recovered a fake password in about 3.5 seconds. Setting CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 stopped telemetry in their tests. Findings rest on one unit per condition, and Anthropic has sent only an automated acknowledgement.
Why it ranked
No. 2 of 110 with a score of 0.75. The panel rated it highest on new information (0.92) and substantiated (0.88), lowest on audience breadth (0.56). The judges disagreed most on audience breadth (spread 0.43), so the story is marked contested.
- AI judgeJudge 2claude-haiku-5-5
- Well-substantiated privacy finding in a major AI coding tool with reproducible steps and a mitigation; single-unit evidence and limited scope temper significance and breadth.
- AI judgeJudge 3gpt-5.6-luna
- A reproducible privacy and telemetry finding in a widely used coding agent, with packet-level evidence, a working opt-out, and a clear reproduction procedure. Scope and prevalence are appropriately limited by the author.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.75total under rubric v2.3Contestedjudges differ by 0.43 on audience breadth
- Significance0.65
- Reader interest0.87
- Audience breadth0.56
- Practical relevance0.84
- Substantiated0.88
- Technical depth0.85
- New information0.92
- Counts against: Promotional0.03
- Counts against: Overclaim0.18
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.64 | 0.60 | 0.72 | 0.65 | 0.12 | +0.24 | +0.156 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.81 | 0.90 | 0.90 | 0.87 | 0.09 | +0.26 | +0.226 |
| Audience breadthHow many people who build technology does it concern? | 0.29 | 0.72 | 0.67 | 0.56 | 0.43 , above the contested threshold | +0.13 | +0.073 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.89 | 0.80 | 0.82 | 0.84 | 0.09 | +0.22 | +0.184 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.98 | 0.80 | 0.86 | 0.88 | 0.18 | +0.05 | +0.044 |
| Technical depthHow technically substantive is it? | 0.99 | 0.80 | 0.75 | 0.85 | 0.24 | +0.05 | +0.042 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.87 | 0.90 | 0.98 | 0.92 | 0.11 | +0.05 | +0.046 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.04 | 0.04 | 0.01 | 0.03 | 0.03 | −0.19 | −0.006 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.20 | 0.25 | 0.08 | 0.18 | 0.17 | −0.11 | −0.019 |
| Sum of contributions | +0.746 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.747 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-29/2/"><img src="https://rubric.hrih.si/badge/2026-10-29/2.svg" alt="Ranked #2 on Rubric, 29 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 7 no source given · 1 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
Claude Code sends Anthropic an unsalted SHA-256 hash of the full contents of files it reads, alongside a device ID and session ID, even when pointed at a DeepSeek model with no Anthropic login.
The article gives no link or citation for it.
The article says “it still sends Anthropic a fingerprint of the files it reads”
The source says No source to compare with.
No source givenVersion
On 27 October 2026, build 2.1.312 (the newest release at that retest) still sent the matching contentHash in telemetry POSTs to api.anthropic.com that returned 200.
The article gives no link or citation for it.
The article says “Retest, 27 October 2026 on build 2.1.312, the latest release at that retest: still present”
The source says No source to compare with.
No source givenVersion
In September 2026, on a Max plan with default settings, Claude Code 2.1.283 also sent the git commit of the repository (head_sha) in telemetry.
The article gives no link or citation for it.
The article says “In September, signed in on a Max plan, it did the same and also sent the git commit of the repository”
The source says No source to compare with.
No source givenNumber
The authors recovered the password from a fake .env file using the hash in about three and a half seconds by guessing offline.
The article gives no link or citation for it.
The article says “We tried it on a fake .env and had the password back in three and a half seconds”
The source says No source to compare with.
No source givenDate
Anthropic only sent an automated acknowledgement after the 26 September report, and the behaviour was still occurring three weeks later.
The article gives no link or citation for it.
The article says “We told Anthropic on 26 September and got an automated acknowledgement, nothing more. Three weeks later it was still happening”
The source says No source to compare with.
No source givenCausal conclusion
Setting CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 stops the telemetry; opt-out runs sent zero telemetry in the authors' tests.
The article gives no link or citation for it.
The article says “You can stop it today: set CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1”
The source says No source to compare with.
No source givenGeneralization
The hash lets someone with the telemetry guess weak secrets in templated files and verify guesses offline, but a properly random API key cannot be recovered this way.
The article gives no link or citation for it.
The article says “a properly random API key cannot be recovered this way. A weak password can”
The source says No source to compare with.
Couldn’t checkNumber
The show_hash.py script is sixteen lines and only reads the request and prints the hash field without sending anything.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “a small script of sixteen lines that prints the fingerprint. Nothing in it sends anything anywhere”
The source says No passage could be compared.
Source cited by the article: agenticbench.org/ant-1/show_hash.py
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 29 Oct 2026, 05:47 UTC. It played no part in the ranking.