Your coding agent may be reporting on your files, whichever model you use
We found that Claude Code sends Anthropic a fingerprint of the files it reads, and it does it even when it is running someone else's model with no Anthropic account involved. We first caught it in September, again on 2.1.303 in October, and again on 2.1.312, the newest release when we retested on 27 October 2026. On a fake .env built from a template, that fingerprint was enough to recover the password in three and a half seconds. The full disclosure is on AgenticBench.
The lesson for anyone building with agents is not about one vendor. The model writes the code, but the harness around it decides what leaves the machine, and almost nobody checks what it actually sends. Documentation tells you what a tool is meant to do; only watching its traffic tells you what it does.
That is the work we do for founders: we run your agent, record what it really sends and does, and hand you the evidence with a script that reproduces each finding.
What we found
Claude Code's default settings post telemetry to api.anthropic.com. Among those events is tengu_file_operation, which for a
file the agent reads carries a contentHash: the unsalted SHA-256 of the file's full contents. The same event carries a
device_id, a session_id and a truncated hash of the file path.
The file itself is not sent. A fingerprint is size-limited and still identifies: a file you know can be recognised from it, and a guessed short secret can be checked against it. We reported this to Anthropic on 26 September 2026. Severity: Medium.
What we retested, and when
Earlier retest on 19 October 2026, build 2.1.303: the fingerprint was still there. Three telemetry posts returned 200, and the 64-hex contentHash equalled sha256sum of the file the agent had read. A 2.1.286 control run produced the same result, and two runs with the opt-out set produced no telemetry at all.
Retest on 27 October 2026, build 2.1.312, the latest release at that retest: still present. Four telemetry posts returned HTTP 200, one file-operation event carried a 64-hex contentHash that again equalled sha256sum of the .env file read, and device_id and session_id travelled on the same event. The 2.1.286 control reproduced it in the same batch, and both opt-out runs sent nothing.
We are not claiming 2.1.312 is still the newest release today, or that nothing changed after it. It was the newest release when we retested on 27 October 2026, and we report what that build did.
What to check this week
If a coding agent runs on your machine with default settings, ask three questions. What does it send, and to which host? Does it send anything derived from the contents of the files it reads? Is there a single setting that turns that off, and have you tested that it does?
For Claude Code, CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 together with the DISABLE_* variables produced zero flows in both
of our opt-out runs. The switch works. The default is what we are writing about.
What this note does not claim
- head_sha was not retested. The September run showed the git commit id in telemetry; the October rig is not a git repository.
- The signed-in state was not retested.
- One unit per condition. That is corroboration, not proof, and it is consistent across 2.1.283, 2.1.286, 2.1.303 and 2.1.312.
- An automated acknowledgement came back on 26 September; no substantive vendor reply is recorded by us, and nothing here is a vendor statement.