Claude Code's Session Leak Got Worse — Remote-by-Default Means Every Commit Carries a URL
Claude Code appends a session URL (https://claude.ai/code/session_...) to the bottom of every commit message and PR description it generates. Opt-in? No. Prompted during onboarding? No. Users discover it after it's already permanently baked into git history. The complaint is back on the HN front page today, and reading the issue thread, the story has quietly gotten worse since June.
Anthropic closed issue #66504 in August with a stopgap: the trailer only appears in web and Remote Control sessions, and you can disable it with "attribution": {"sessionUrl": false}. That carve-out was already flimsy — those are exactly the sessions with no local shell to edit ~/.claude/settings.json. But this week users report something bigger: all sessions are remote by default now. /rc is active in every session. Which means Anthropic's own exclusion no longer exists — the URL is in everything.
Why this matters beyond annoyance:
- Git history is forever. A private repo that goes public, a fork, a leak — the session ID ships along, one click from the session contents.
- The "fix" is undiscoverable by design. A flag in a settings file you can't edit from the surface that writes the trailer.
- It's default-on telemetry-shaped attribution. Opt-out provenance is marketing, not credit.
Verdict: check your git log today. If you've used Claude Code in remote mode, the link is in there. The fix exists but misses the point — this should have been opt-in at first commit, not a buried flag after four months of noise.