A model cannot phone home. Its harness can.
That's the sentence AgenticBench uses to frame a disclosure about Claude Code, and it's the most useful idea in the note. Point the tool at another company's model, don't sign in to Anthropic at all, and it still sent Anthropic a fingerprint of the files it read — an unsalted SHA-256 of the file's full contents, alongside a device ID and a session ID.
They caught it on 19 October on version 2.1.303, and again on 27 October on 2.1.312, with a DeepSeek model doing the work and no Anthropic account in the setup. In September, signed in on a Max plan, it also sent the git commit of the repository.
A hash is not anonymity
The obvious defense is that the file contents never leave the machine, and that's true. It's also not the point.
An unsalted SHA-256 is a stable fingerprint. If you know most of a file's contents — and for a .env built from a template, you usually do — you can guess the secret and check each guess against the hash offline. AgenticBench tried it on a fake .env and recovered the password in three and a half seconds.
That's the whole finding in one attack: the telemetry doesn't need to contain the secret for the secret to be recoverable. Hashing is pseudonymization, not anonymization, and the distinction only matters when the input space is guessable. Password hashes have known this for decades; file hashes are the same problem with a different name.
The note is fair about limits: a properly random API key can't be recovered this way; a weak password can. They rate it Medium. That's the right severity, and it's also why the finding is easy to dismiss. Most files aren't secret. The ones that are, are the ones that matter.
The default is the story
The opt-out works: CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 produced zero telemetry in their tests, and the model call still completed. The note publishes the proxy setup so anyone can reproduce it.
But it's opt-out, and the surprising part isn't the existence of telemetry — it's that it flows when you're using a competitor's model, with no Anthropic account, in a setup where you might reasonably assume you're outside Anthropic's telemetry altogether. That assumption is wrong, because the harness is Anthropic's software regardless of whose model it calls.
That's the general lesson, and it applies well beyond this product: the trust boundary in an agent stack is the tool, not the model. The model sees your prompt. The harness sees your files, your shell, your git repo, and your network. Auditing the model provider while ignoring the harness is auditing the wrong component.
The disclosure timeline
Reported to privacy@anthropic.com on 26 September. Automated acknowledgement the same day, no substantive reply recorded. Still present on 19 October. Still present on 27 October. Published 28 October.
Three weeks is a long time for a fix that amounts to "don't send this, or salt it per install." The note doesn't editorialize much; the dates do it.
The limits section is unusually good: one unit per condition, the signed-in state not retested, head_sha not retested because the rig wasn't a git repo. They say the September capture and the binary's strings are the evidence for that part. That's how a disclosure should be written — claims bounded by what was actually observed.
What the fix looks like
Three options, in increasing order of effort:
Default it off. Non-essential traffic should be opt-in, especially when it includes file fingerprints.
Salt the hash per installation. A per-install random salt makes the fingerprint useless for cross-user matching and offline guessing, while preserving whatever deduplication the telemetry is for.
Don't hash the contents at all. If the purpose is "which files did the agent read," a path or an extension is enough for most product analytics. The content hash adds little and costs a lot.
The uncomfortable part
This is a Medium finding about a tool many people trust with their whole codebase, and the response will likely be a setting nobody changes. That's the pattern: telemetry defaults are set by the vendor's need for data, and the cost is borne by the small number of users whose files contain something sensitive.
The honest way to think about it is not "is this a breach" — it isn't — but "what does the harness know, and who can use it." A fingerprint of every file an agent reads is a map of your repository, and a map is a lot to hand over by default.