Claude Code sends file hashes to Anthropic even on DeepSeek

A disclosure note Agenticbench published on October 28 found that Claude Code sends Anthropic an unsalted SHA-256 hash of the files it reads. It does this even when a DeepSeek model does the work and no Anthropic account is involved, and from one of those hashes the authors recovered the password in a fake .env in three and a half seconds. If a file your agent reads holds a guessable secret, setting CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 stopped the telemetry completely in their tests. They rate the issue Medium, because a properly random API key can’t be recovered this way.

The switch has a known side effect. In September, Claude Code 2.1.280 was found to skip AGENTS.md entirely when this variable or DISABLE_TELEMETRY=1 was set. The plugin that loads the file checks a remote feature flag and treats the flag as off when it can’t fetch it. On that build, a team that relied on AGENTS.md and blocked the traffic to stop the hashes would also have lost its agent rules, with no warning.

The hash is not the file, and no file contents leave the machine. But because the hash is unsalted (no random value is mixed in before hashing), the same contents always produce the same 64-character value, and anyone can compute it. A .env built from a template is mostly predictable. Whoever holds the telemetry can try candidate values for the one secret in it and check each guess against the hash offline. The hash also travels on the same event as a device ID and a session ID. A weak password falls to this. A random key does not.

The first capture came in September, on Claude Code 2.1.283 with default settings and a Max account signed in. The telemetry event to api.anthropic.com carried the hash and also the repository’s git commit. The logged-out DeepSeek retests followed. On October 19, on 2.1.303, three POSTs returned 200 with a contentHash matching sha256sum of the file read. On 2.1.312, the newest release at the time of the second retest, four telemetry POSTs went out and one file-operation event carried the matching hash. A 2.1.286 control run reproduced the result both times. Runs with CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 set alongside the DISABLE_* variables sent no telemetry at all.

The note sums up the finding as “A model cannot phone home. Its harness can.” DeepSeek’s own documentation presents running Claude Code on its models as a supported integration. An existing install only needs environment variables: ANTHROPIC_BASE_URL pointed at DeepSeek’s Anthropic-compatible API and a DeepSeek key in ANTHROPIC_AUTH_TOKEN.

The authors sent their report to privacy@anthropic.com on September 26 and got an automated acknowledgement the same day. Three weeks later the hashes were still going out, and they were still there on October 27, a month after the report.

Some findings rest on less evidence than others. The retest workspace was not a git repository, so the git commit finding depends on the September capture and on the string’s presence in the binary. The signed-in state was not retested either. Each condition ran on one unit, which the authors call corroboration rather than proof, though the result held across 2.1.283, 2.1.286, 2.1.303 and 2.1.312. They report what 2.1.312 did as the newest build at the time of their last retest. They don’t claim it is still the newest release, or that nothing has changed since.