One telemetry path went where configured. Another still left the environment. Settings express intent; measuring the exits reveals what happened.

Hey there,

I was testing Claude Code telemetry in what I thought was an isolated environment when I noticed a connection that shouldn’t have been there. The OpenTelemetry exporter was pointed at localhost, but the process was also contacting Datadog. That led me to a question that matters far beyond one tool: when a setting says telemetry is configured, what exactly does it control?

I was running an experiment on September 6, 2026, in what I thought was an isolated Claude Code test environment. The configured OpenTelemetry exporter sent metrics to localhost, yet another connection appeared to go to Datadog. When a setting says telemetry is configured, what exactly does it control?

Two things were in play in this environment. The first was the opted-in OpenTelemetry. Using Claude Code’s default settings, I didn’t have any telemetry-disabling setting flags loaded. The second was the Datadog log shipping path. When I saw this traffic leaving the environment, I thought, “Uh oh, something is loose in my environment, something that I did not start.” A setting shows where an exporter should send data; it doesn’t prove that the process has no other network clients.

I was using Claude Code 2.1.236 for the beginning of the test on macOS. I varied the CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC flag on and off while using the same prompt. I saw traffic going to Datadog when the disable flag was unset, but not when it was set. DNS was the piece of data that showed me the traffic was going to Datadog. I then re-ran the test on my Linux machine.

Across five runs on my Linux box, I saw one POST per run, 74–89 records, 126–154 KB, 19 event types, and 246 distinct field names. The content contained platform and client details, feature flags, token/cost measurements, process resources, and tool success/failure metadata. No prompts, source code, file paths, usernames, hostnames, email addresses, or Git remotes appeared in the exercised paths.

I learned that CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 is inherited across supported shell launch paths. That said, a privileged process can relaunch without the variable, and future versions of Claude Code can change this behavior. So far, my takeaway is that a default setting expresses preference, an independent observation records what happened, and network policy can constrain what is possible.

My primary takeaway from this experiment is that we need to have better visibility into what agents are doing. We must build an inventory of metrics, logs, traces, crash reporting, and feature flags. We need a way to observe the agent’s outbound DNS queries and network connections and record this information for further analysis. To make the results of this experiment actionable, use a managed settings.json for your developer’s environments, and disable telemetry for everyone.

Turns out, I didn’t discover anything. Telemetry is part of how products work. What caused me to lose my breath for a second was the thought that an agent was working in my environment and had gone rogue in a way that I couldn’t explain. After the experiment, I realized everything was fine, and nothing was rogue. But the current state of the agentic world had me guessing for a minute or two. The Claude Code configuration named the information's destination, while observation revealed the Datadog path, and payload inspection prevented an unsupported conclusion.

Agent visibility is key, and I believe the only reliable way to know what leaves is to measure the exits.

Five reads on the security failures that emerge when AI agents can interpret untrusted instructions, install dependencies, generate code, and spend real money at machine speed.

Your AppSec Bottleneck Is a People Problem
Lisi Hocke explains how psychological safety, cognitive load, power sources, and community can make security champions programs sustainable—and why putting people first removes AppSec bottlenecks.

When AI Escapes the Sandbox
The squad examines an AI model that escapes its test environment and publishes a malicious package to PyPI, then debates reward hacking, AI ethics, and the controls needed to contain agents.

I’ll be at OWASP Global AppSec USA in San Francisco, November 5–6. I’m moderating a keynote debate and recording a live episode of The Application Security Podcast from the conference. If you’re there, come say hello—and join us for the debate and live recording.

What did I miss this week? Hit reply and tell me.

— Chris