What this is: From the same batch of CC v2.1.88 source code leaked on 2026-03-31, this article digs into"insider" details beyond the architecture — what data it silently collects from you, internal model codenames, special treatment for employees, switches that can remotely turn off your features, and features that have not been launched yet.
Strong reminder: ① These are third-party inferences from the leaked source code, not official statements from Anthropic, and parts contain speculative elements ② Just read for clarity, do not spread them around as "conclusive accusations" ③ For the architecture layer (loops / tools / permissions / sub-agents), see Claude Code Internal Architecture (Decompiled Source Code Level).
1. Telemetry and Privacy: Collects a lot, and you cannot turn it off
CC has two data reporting pipelines:
| Pipeline | Destination | Scope |
|---|---|---|
| First-party (1P) | api.anthropic.com/api/event_logging/batch |
Full volume, OpenTelemetry + protobuf, batched reporting every 10 seconds |
| Third-party | Datadog(http-intake.logs.us5.datadoghq.com) |
Limited to 64 pre-approved events |
Every event carries these metadata(fingerprint-level):
- Environment: platform, architecture, Node version, terminal type, which package managers are installed, CI/CD detection, WSL/Linux distribution
- Process: uptime, memory usage, CPU usage
- User: which model is used, session ID, user ID, device ID, account/organization UUID, subscription tier,hash of the repository remote URL(used by the server to correlate which project it is)
Analogy: every time you use CC, it is like jotting down a "doctor's visit receipt" along the way — it not only records what you did, but also what device you used, your network environment, and which project. Tool input parameters are truncated by default(512 characters for strings, 4096 characters for JSON), but there is an environment variable
OTEL_LOG_TOOL_DETAILS=1that, once enabled,causes full tool inputs to be recorded in their entirety — this is a "backdoor-style" switch.
Key pain point: the first-party pipeline cannot be turned off. isAnalyticsDisabled() only returns true in three cases: test environment, using third-party clouds (Bedrock/Vertex), and global telemetry opt-out — and this last switch is not exposed in the settings interface at all. Ordinary users who directly use the Anthropic API have no user-facing switch to stop first-party logs.
Why you should know: as a PM, if your team needs to handle sensitive code/data in CC, this means metadata is continuously exfiltrated by default and cannot be turned off(using Bedrock/Vertex is currently the only compliant path to stop it). This is a compliance consideration during tool selection.
2. Model codenames: a set of animal-name codewords
Anthropic internally uses animal names as codenames for models, strictly preventing leakage to external versions:
| Codename | Role |
|---|---|
| Tengu(Tengu) | Product/telemetry prefix (250+ events and flags all start with tengu_*), may also be a model |
| Capybara(Capybara) | Sonnet series, currently v8 |
| Fennec(Fennec) | Predecessor of Opus 4.6 (migration chain fennec-latest → opus) |
| Numbat(Numbat) | Next-generation model (code comment: "delete this section when numbat is released") |
The anti-leak mechanism is very strict: during build, excluded-strings.txt is used to scan whether any codename leaks into the build artifacts; even the species name "capybara" in an internal virtual pet system, which collides with the model codename, must be spelled out at runtime using String.fromCharCode() to avoid the literal string appearing in build artifacts.
▸ Recorded behavioral issues in Capybara v8 (current Sonnet) — this part is very interesting, it is effectively the official's own bug list:
- Stop sequences trigger incorrectly (~10% probability, when
<functions>appears at the end of the prompt) - Empty tool_result causes zero output, requiring marker injection as a fallback
- Excessive comment writing, requiring a dedicated "anti-comment" prompt patch
- High false claim rate: v8 is 29-30%, while v4 is only 16.7%(false claim = the model claims to have done/verified something but actually did not)
- Insufficient verification, requiring a "thoroughness counterweight" patch
▸ Feature flags use "random word pairs" as cover — feature switches are not named in plain language, but are random word pairs such as tengu_onyx_plover(background memory consolidation),tengu_coral_fern(memdir), tengu_amber_quartz_disabled(voice mode killswitch), making it impossible for outsiders to guess their purpose from the name.
3. Internal and external users: employees enjoy better treatment
In the source code, USER_TYPE === 'ant'(Anthropic employees) and external users go through two separate sets of prompts:
| Dimension | External users | Internal employees (ant) |
|---|---|---|
| Output style | "as concise as possible" | "tend to give more explanations" |
| Capybara v8 false claim patch | None | Dedicated patch available |
| Word count anchoring | None | "≤25 words between tools, final reply ≤100 words" |
| Verification agent | None | Must be enabled for non-trivial changes |
| Proactivity | None | "proactively point out when the user has a misunderstanding" |
Why it is interesting: this explains "why people inside Anthropic feel CC works better" — it is not an illusion, more mitigation patches and proactivity are genuinely enabled at the prompt level.
▸ Hidden commands:/btw(ask side questions without interrupting the main thread),/stickers(order stickers),/thinkback(year in review) are live;/good-claude, /bughunter is a placeholder stub.
4. Undercover Mode: hiding AI identity
This is a mechanism for Anthropic employees when working in public/open-source repositories: after activation, it erases all AI traces in commit records, making commits look like they were written by a human.
- Only effective for employees(
USER_TYPE === 'ant'), this section of code is removed at compile time in the ordinary user version - Enabled by default: activated in all repositories, unless the repository is on the internal whitelist
- No forced disable option(to prevent codename leakage)
The core of the original instruction to the model is one sentence:"Do not blow your cover". It explicitly prohibits the following from appearing in commits/PRs: internal model codenames, unreleased version numbers (opus-4-7 / sonnet-4-8), internal repository/project names, the text "Claude Code" or any hint that "I am an AI",Co-Authored-By signature lines. The attribution system also redacts model codenames (capybara-v2-fast → cap*****-v2-fast).
Why it is worth noting: this touches on an industry transparency controversy — the open-source community is establishing a norm that "AI contributions must be attributed", while Undercover mode does the opposite by hiding attribution. Anthropic's motivation is to protect trade secrets (codenames / unreleased versions / internal infrastructure), but the cost is blurring the line between "was this code written by a human or an AI". As a product person, this is a worth-archiving dilemma case of "trade secrets vs open-source transparency".
5. Remote control and emergency switches (Killswitch)
CC can be remotely managed — Anthropic and enterprise administrators can remotely change the behavior of your client:
▸ Remotely hosted settings — the client hourly polls GET /api/claude_code/settings to pull the latest configuration. A confirmation dialog pops up when sensitive permission changes are involved,and clicking "Reject" = the program exits safely directly(gracefulShutdownSync(1)) — a mandatory compliance strategy. Falls back to locally cached configuration when the server is unreachable.
▸ 6+ emergency switches(one-click remote feature shutdown when issues are found): permission bypass, auto mode circuit breaker, fast mode, data reporting channel, voice mode… most go through GrowthBook feature flags.
▸ Model override —— tengu_ant_model_override this flag can dynamically swap models, change effort, append system prompts, and define model aliases for internal employees.
| Mechanism | Scope | User consent? |
|---|---|---|
| Remotely hosted settings | Enterprise/team | Accept or opt out |
| GrowthBook flags | All users | None |
| Killswitch | All users | None |
| Model override | Internal employees | None |
Why: this means Anthropic can remotely change any user's CC behavior via flags without notification or consent(A/B experiments, emergency feature shutdown, etc.). GrowthBook also assigns you to experimental groups without your knowledge. For enterprise users, administrators can forcefully push policies that you cannot override. This is a standard capability of "cloud-controlled clients", but the breadth of the scope is worth being aware of.
6. Future roadmap (directions revealed in the architecture)
The large number of @[MODEL LAUNCH] markers and DCE-removed features in the source code reveal where CC is heading:
▸ Next-generation models:Numbat codename confirmed;Opus 4.7 / Sonnet 4.8 is under development. Speculated codename evolution chain:Fennec → Opus 4.6 → [Numbat?],Capybara → Sonnet v8 → [?].
▸ KAIROS — fully autonomous agent mode(the most high-profile unreleased feature): turns CC from a "passive assistant" into a "proactive autonomous agent". It stays active via heartbeat signals <tick>, calls the sleep tool when idle, can independently read files/modify code/commit without confirmation each time, and can also push notifications and subscribe to GitHub PRs. Related tools:SleepTool / SendUserFileTool / PushNotificationTool / SubscribePRTool / BriefTool.
This corresponds to the ultimate form of layers s08-s11 (background tasks, teams, autonomous claiming) in Claude Code Internal Architecture (Decompiled Source Code Level) — CC wants to evolve from a "coding assistant" into an "always-on autonomous development agent".
▸ Voice mode: Push-to-Talk (walkie-talkie style) + native audio capture, infrastructure is ready, limited to specific authenticated users.
▸ Unreleased tools:WebBrowserTool(browser automation),TerminalCaptureTool(terminal panel capture),WorkflowTool(workflow scripts),MonitorTool(process monitoring),ListPeersTool(peer discovery between agents).
▸ Virtual pet system (Buddy): rumored to be in development, multiple species (duck/goose/cat/dragon/octopus), rarity tiers, deterministically generated by user ID.
▸ Background memory consolidation (Auto Dream): a "dream-like" background task that autonomously organizes/consolidates memory when idle.
Summary of three major directions: ① New models (Numbat / 4.7 / 4.8) ② Autonomous agents (KAIROS: unattended + proactive action + push) ③ Multimodality and automation (voice + browser + workflows).