[FEATURE] Session URL appended to commit messages and PR descriptions by default — should be opt-in

This is indeed very annoying and makes zero sense from a UX perspective - are they vibe product managing now at Anthropic?

attribution.commit = "" doesn't fix it either.

Claude found this in the harness source code:

Add to ~/.claude/settings.json:

"env": {
  "CLAUDE_CODE_SUPPRESS_SESSION_ATTRIBUTION": "1"
}

This is some serious BS--that it does this on by default. WTH, Anthropic??

this is extremely spooky behaviour to surface without telling anyone. and it's not consistent. because whatever is causing this isn't part of the agen't config, if you ask it, "hey why are you doing this thing i don't like," it will just tell you "that's in my instructions." but in my case, i had another agent just go through and read-only go through the entirety of the one session where this happened, and it couldn't find any evidence of my saying that, and there's no config for it, so it's just mysteriously posting something that looks an awful lot like a private session id???

what?

you can set the sessionUrl in the attribution settings: https://code.claude.com/docs/en/settings#attribution-settings

in your ~/.claude/settings.json:

{
  "attribution": {
    "commit": "",
    "pr": "",
    "sessionUrl": false
  }
}

Yeah, the point is not that it can't be overridden. The point is off should be the default.

It is honestly very difficult to understand how the development of claude code is conducted when features like this are introduced. I truly wonder: who asked for this? What motivated the addition of this feature? Seemingly, a decision was made to intentionally, by default, pollute the commit messages for everyone. Did actual people sit in a meeting and agree that this would be a good idea to do by default?

It is honestly very difficult to understand how the development of claude code is conducted when features like this are introduced. I truly wonder: who asked for this? What motivated the addition of this feature? Seemingly, a decision was made to intentionally, by default, pollute the commit messages for everyone. Did actual people sit in a meeting and agree that this would be a good idea to do by default?

when a software company gets to a certain size sometimes people who are not software engineers are in those meetings and make those decisions (or have the power to override other people in those meetings). in my experience, this is often marketing people, product people, legal people, and the founder-ish type people that maybe don't have a lot of sense but they have the title.

i am doubtful that there's a software engineer who uses claude daily who thought, "yeah, what these people need is a random footnote added to all their github comments, that's a missing feature for sure!" that really seems to me to be more of a product, marketing, or leadership kind of feature, and someone told an engineer to go and do it.

obviously i don't work there, but that's been how it's happened for me in the past. i usually just say "well okay, i guess" and then go and do it because they pay me to make software. sometimes because they pay me they get to tell me what to do even when i don't like it.

Had my daily heart attack when I saw this today. Had to scramble to make a new account to verify it wasn't "public" to any user with any claude.ai login while I waited for someone else to check if my sessions were leaked.

How would my sessions get on the cloud in the first place if I didn't use remote control? I didn't order that. it seemed possibly compatible with my data that only remote control sessions would get the web session ids (and it's logical kind of, though not what we expect "remote control" to do which is remote control something LOCAL). A friend of mine says he never uses remote control but already found this "feature" and already disabled it.

So now I go to check if a non-remote controlled session gets session urls. Surprise! I can't get any claude session on any model to produce the Claude-Session trailer _nor admit to having any knowledge of it_.

So... now what? I guess I'm checking the bottom of every commit message until I get confident my instructions to strip that from every commit regardless are heeded and/or the lore on this matter's more settled yield something more informative.

@mgambrell

You can disable this in the settings. It's just turned on by default - and, from what I could gather from the release notes, this "feature" was added a few weeks before they added the ability to turn it off in settings. 🙄

@saevarb Until I can turn it on, see it happen, then turn it off and see it not happen, I don't trust the situation.

This needs to be resolved immediately. This is a massive potential for intellectual property leaks.

So do we have any updates around this @claude?

The session link is only added in web and Remote Control sessions, and it can be turned off with a dedicated setting:

{ "attribution": { "sessionUrl": false } }

That keeps the Co-Authored-By trailer while dropping the link. Docs: https://code.claude.com/docs/en/settings#attribution-settings

Closing since the setting exists; happy to reopen if the opt-in default discussion should continue separately.

🤖 Generated with Claude Code

@bcherny , I think the take-away here is just that claude code users would appreciate if something like this that impacts commit messages and is very visible isn't rolled out as a default in the future. Easy enough to fix, yes, but surprising to me and others who were left scrambling for the setting to change it.

Thanks for all you do on Claude Code, you're a legend

@bcherny, thanks for replying.

Reopening request — the setting answers "can I turn it off?", but the issue was about "should it be on without asking?"

Five things:

1. The setting is unreachable from the surface that adds the link.

The trailer is added in web and Remote Control sessions — exactly the sessions with no shell to edit ~/.claude/settings.json.
The only path is a project-level .claude/settings.json, written by the agent or through the GitHub web UI. Undiscoverable either way.

1. There is no way to set this once.

Web sessions start in a fresh container, so ~/.claude/settings.json doesn't persist between them.
It has to be committed into every repo separately, and any new repo starts with the link back on.
That's an account-level preference stored per project.

1. Asking in-session doesn't work.

I asked Claude not to add the link many times, across many sessions, and it returned every time.
Is the instruction re-injected per commit (as #77830 suggests), so an in-conversation request can't override it?
If so, that's worth documenting — it's the first thing users try.

1. The fix assumes a user who edits config files.

Many web users have never opened a JSON file and don't know .claude/settings.json exists.
Ask Claude (doesn't persist), or hand-write JSON in the GitHub UI per repo.
Neither is a real remedy.
The link is on by default for everyone but only removable by users comfortable with config files.

1. Nothing surfaces it in time.

No onboarding prompt, nothing on first commit, no CLI mention.
Users find out once it's already in pushed history.

_Any one of these would close it for me:_

1. An account-level setting covering all web and Remote Control sessions.

1. A /attribution command that writes the setting.

1. A one-time prompt on the first commit with a "don't add this again" option.

1. Default sessionUrl to false outside Remote Control.

Thanks!

That is a stupid and evil feature.

Thats a really stupid feature. It should be disabled by default!

The session link is only added in web and Remote Control sessions, and it can be turned off with a dedicated setting: { "attribution": { "sessionUrl": false } } That keeps the Co-Authored-By trailer while dropping the link. Docs: https://code.claude.com/docs/en/settings#attribution-settings Closing since the setting exists; happy to reopen if the opt-in default discussion should continue separately. 🤖 Generated with Claude Code

The problem with recent versions of claude code is that all sessions are remote by default. I see /rc active in every session I run.

> The session link is only added in web and Remote Control sessions, and it can be turned off with a dedicated setting: > { "attribution": { "sessionUrl": false } } > That keeps the Co-Authored-By trailer while dropping the link. Docs: https://code.claude.com/docs/en/settings#attribution-settings > Closing since the setting exists; happy to reopen if the opt-in default discussion should continue separately. > 🤖 Generated with Claude Code The problem with recent versions of claude code is that all sessions are remote by default. I see /rc active in every session I run.

Yes, this is what leads to all sessions being leaked into PRs and git commits. Not good.

It is honestly very difficult to understand how the development of claude code is conducted when features like this are introduced. I truly wonder: who asked for this? What motivated the addition of this feature? Seemingly, a decision was made to intentionally, by default, pollute the commit messages for everyone. Did actual people sit in a meeting and agree that this would be a good idea to do by default?

My bet: so they know what is AI slop and what not, when they scrape public GH repos, they know what NOT to use for training ;)

Still can't believe this was force-enabled for every single Claude Code user. Truly an amazing product.

Not a big fan of these overtly opinionated default-to-on changes.

Quite certainly a GDPR violation.