Anthropic says Claude Code v2.1.281 fixes a bug that could silently skip a repository's AGENTS.md instructions when a user disabled telemetry or nonessential traffic. The incident matters because those local files often carry build, test and security rules: a privacy choice changed what the coding agent was told to do.
Key facts
-
AGENTS.mdsupport arrived in Claude Code v2.1.277. - A remote
tengu_agents_md_modrollout flag could resolve false when telemetry-related traffic was disabled. - Anthropic's docs say some affected sessions before v2.1.281 read only
CLAUDE.md. - Primary source: Anthropic's current memory documentation.
The mechanism was a feature flag, not the content of the instruction file. A detailed independent report and GitHub issue #95690 found that the built-in agents-md Mod was off unless it received the remote rollout decision. When nonessential traffic was disabled, the flag was unavailable and the loader fell back to false. The user received no warning that a local project instruction file had not been read.
Anthropic's environment-variable documentation independently confirms a non-obvious detail: DISABLE_TELEMETRY and CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC are presence-based. Setting a variable to 0 still activates the opt-out. The current Mod documentation says its telemetry records counts and closed choices rather than paths or file contents. So “telemetry gate” should not be misread as an allegation that Anthropic collected the file text.
The practical failure was worse than a missing convenience feature. AGENTS.md is used by several coding-agent tools as a shared project convention; it may specify how to run tests, prohibit touching generated files, restrict secrets handling, or require review of a particular directory. An agent that starts normally but lacks those constraints can produce plausible changes that fail the repository's actual contract. This is an instruction-integrity issue adjacent to prompt injection: in one case hostile text adds unwanted instructions; here a configuration silently subtracts trusted ones.
Anthropic maintainer mpoteat described the behavior on Hacker News as a “rollout artifact,” explaining that the team wanted a kill switch and should have designed it differently. That is the strongest counterargument to claims of intentional privacy coercion. Yet it leaves the engineering conclusion intact: an offline or privacy-restricted state cannot silently alter the semantics of a local file loader.
Update to v2.1.281 or later, then test a minimal repository with only AGENTS.md in the same environment your team actually uses—proxy, Bedrock, gateway and telemetry-disabled sessions included. For compatibility, the original report's workaround was a CLAUDE.md containing @AGENTS.md. The larger security lesson is durable: dependency failure should fail closed with an explicit warning when it removes policy from an autonomous coding workflow.
Originally published on Ground Truth, where every claim is checked against the primary source.
Top comments (0)