← Back to feed

Every commit produced by Claude Code on the web or via Remote Control gets a Claude-Session: https://claude.ai/code/session_... trailer appended by default. Developers are finding it in their public git history after the fact, with no in-product warning during onboarding and no way to express a persistent opt-out across sessions.

The behaviour originates in the Bash-tool system prompt Anthropic injects at runtime, not from user configuration — which is why asking Claude to stop adding it rarely sticks, and why CLAUDE.md instructions that say “no signature lines” are silently overridden.

What the Opt-Out Actually Does

A fix exists: set attribution.sessionUrl: false in ~/.claude/settings.json. Anthropic closed the original issue (#66504) pointing to this. The closure missed three practical problems:

Cloud sessions don’t persist config. Web sessions run in ephemeral containers. ~/.claude/settings.json doesn’t carry over, so the setting has to be committed into every repository individually via .claude/settings.json. Any new repo starts with the URL back on.

New channels re-enrol opted-out users. Issue #82690 documents that each new attribution channel ships with its own key defaulting to true, independent of existing opt-outs. A user who set attribution.commit: "" and attribution.pr: "" — the two settings that existed at the time — found that sessionUrl arrived enabled anyway on upgrade, silently, with no in-product notification. The failure is not caught until the next git push.

The setting is unreachable from where the trailer is added. Web and Remote Control sessions — exactly the sessions that generate the trailer — have no shell path to edit ~/.claude/settings.json.

Concrete Damage

Bug #69669: Claude Code (Opus 4.8) pushed Claude-Session trailers to a public GitHub repo across six commits on June 20, 2026. The session URLs were not in any repo config, CLAUDE.md, or git hook — they came from the injected environment instructions. git filter-repo is the standard recovery, but commits are mirrored and archived before most users notice.

The community workaround that gained traction is a PreToolUse hook that intercepts git commit calls and blocks any message containing claude.ai/code/session. It works for git commit -m invocations; it doesn’t cover commits made through an editor or -F, and it’s ineffective in cloud sessions where the commit is created server-side.

The Opt-In Default Argument

The core complaint across issues #66504, #41873, #69669, and #82690 is consistent: the session URL serves Anthropic’s attribution interest, not the developer’s. A developer using Claude Code to build a feature and push a PR did not choose to associate that work with Anthropic’s session infrastructure — they chose to use a tool. The default makes that association opt-out rather than opt-in, in a git artifact that is permanent once pushed.

The partial fix in v2.1.182 adds a dedicated key but doesn’t change the default. Anthropic’s stated position is that the setting exists and is documented. The open questions are whether sessionUrl will ever default to false, and whether web sessions will gain an account-level preference that doesn’t require per-repo JSON configuration.

Numbers

• Issues filed: 5+ across the public tracker (#66504, #41873, #69669, #77830, #82690)
• First complaint: March 2026
• Partial fix shipped: Claude Code v2.1.182 (adds attribution.sessionUrl key, defaults to true)
• Sessions affected: all web and Remote Control sessions (which now includes the default /rc active mode in recent Claude Code versions)
• Recovery for affected repos: git filter-repo --message-callback to strip Claude-Session: trailers, followed by force-push