LAUNCH KIT · COPY THE FACTS, KEEP THE LIMITS

Packets first. Adjectives on probation.

Copy-ready text generated from the current measured dataset. Edit it like a person. Never paste the same reply into unrelated threads.

POSTING RULE

One relevant post or reply per conversation. Answer questions before adding another link. Never call an observed request spyware, tracking, training or sale without separate evidence.

CURRENT COPY

Five formats. One evidence contract.

X / Bluesky

Finally, an AI benchmark the model cannot sweet-talk.

I ran exact Claude Code and Codex CLI builds in fresh homes with fake keys and watched the wire for 45 seconds, three times each.

Claude 2.1.232: 29/29/29 requests on defaults; 9/9/9 with its documented nonessential-traffic opt-out.
Codex 0.147.0: 20/20/20 in one batch and 18/20/18 in another.

No privacy score. No spyware fanfic. Just versioned packet receipts, limitations and public sanitized runs.

https://isitanagent.com/?src=x_phonehome_launch

Hacker News

Show HN: Does It Phone Home? Versioned network receipts for AI coding CLIs

I built a small independent lab for one boring question: what destinations and route shapes does an exact AI coding CLI build contact in a fixed scenario?

The current protocol runs each configuration three times from a fresh HOME and workspace, with fake credentials, a fixed 45-second window and a pinned capture stack. Raw captures stay private because they contain bodies; sanitized per-run JSON is public and bound to its SHA-256.

The site deliberately does not infer purpose, retention, training use or whether a tool is “private.” A hostname is not a motive. Divergent batches are labelled variable instead of averaged into a magic score.

New upstream npm releases are detected hourly and queued for the same retest.

Lab: https://isitanagent.com/?src=hn_phonehome
Method: https://isitanagent.com/methodology
Machine data: https://isitanagent.com/api/phone-home.json

Reddit · Claude Code

I got tired of Claude telemetry arguments where one side links a privacy policy and the other types SPYWARE in 48-point text. So I measured a narrower thing.

Claude Code 2.1.232, fresh HOME, invalid canary key, fixed 45-second window, three runs:

• defaults: 29/29/29 requests
• documented nonessential-traffic opt-out: 9/9/9 requests

The opt-out removed every nonessential route observed by this protocol. That does not prove what happens in a real authenticated coding session, why a request exists, or what a server retains.

Per-run sanitized JSON and hashes are public, so please attack the evidence rather than my adjective budget:
https://isitanagent.com/claude-code/telemetry?src=reddit_claude_telemetry

Reddit · Codex

I ran Codex CLI 0.147.0 through the same clean-start network test twice. The first 3-run batch produced 20/20/20 requests. The validation batch produced 18/20/18.

That difference is the interesting part: a single clean trace would have looked authoritative and been wrong about stability. The page labels the cross-batch destinations VARIABLE instead of turning the counts into a score.

Exact build, scenario, limitations, hashes and sanitized run manifests:
https://isitanagent.com/codex/telemetry?src=reddit_codex_network

Security newsletter

Subject: Versioned packet receipts for Claude Code and Codex CLI

Does It Phone Home? is an independent release-triggered network lab for AI coding CLIs. Each result is scoped to an exact build, OS image, configuration, fixed scenario and repeat count. Public artifacts include route-level observations, sanitized per-run JSON and content hashes.

The first current results show a reproducible default-vs-documented-opt-out difference in Claude Code 2.1.232, and cross-batch variability in Codex CLI 0.147.0. The site does not assign privacy scores or infer server-side purpose and retention.

https://isitanagent.com/?src=newsletter_phonehome