Claude Code's default telemetry sends Anthropic SHA-256 hashes of files it reads

Point Claude Code at another company's model, don't log in to Anthropic at all, and it still sends Anthropic a fingerprint of the files it reads. We caught it doing exactly that on 19 October on version 2.1.303, and again on 27 October on version 2.1.312, the newest release at the time of that retest, with a DeepSeek model doing the work and no Anthropic account anywhere in the setup. In September, signed in on a Max plan, it did the same and also sent the git commit of the repository.

The fingerprint is an unsalted SHA-256 of the file's full contents, sent next to a device ID and a session ID. It isn't the file, and Anthropic would be right to say so, but it is far from harmless. If you know most of what is in a file, and for a .env built from a template you usually do, anyone holding that telemetry can guess the one secret in it and check each guess against the fingerprint offline. We tried it on a fake .env and had the password back in three and a half seconds.

We told Anthropic on 26 September and got an automated acknowledgement, nothing more. Three weeks later it was still happening. You can stop it today: set CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1. We rate it Medium: no file contents leave your machine, and a properly random API key cannot be recovered this way. A weak password can.

Original capture, September 2026, Claude Code 2.1.283, Max account, default settings: a telemetry event to api.anthropic.com whose contentHash equalled sha256 of the file the agent had read, sent alongside the device and session ids.

Earlier retest, 19 October 2026 on build 2.1.303: the fingerprint was still present. Three POSTs returned 200, and the 64-hex contentHash matched sha256sum of the file read, on the same event that carried device_id and session_id. A 2.1.286 control run produced the same result, so the measurement itself is working.

Retest, 27 October 2026 on build 2.1.312, the latest release at that retest: still present. Four telemetry POSTs to api.anthropic.com returned 200, one file-operation event carried the matching contentHash, and the 64-hex contentHash again matched sha256sum of the file read, with device_id and session_id on the same event. The 2.1.286 control reproduced it in the same batch, and both opt-out runs sent zero telemetry.

The file's contents are not transmitted. A fingerprint is still identifying: a file we know can be recognised from it, and a guessed short secret can be checked against it. That is why we treat it as a privacy finding rather than a curiosity.

Setting CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 together with the DISABLE_* variables produced no telemetry in our tests. The opt-out works.

26 September 2026: report sent to privacy@anthropic.com. An automated acknowledgement came back the same day; no substantive reply is recorded by us, and nothing in this note should be read as a vendor statement. 19 October 2026: retest on build 2.1.303. 27 October 2026: retest on build 2.1.312, the newest release at that time. 28 October 2026: published.