A Claude Code user reports that remote sessions in version 2.1.257 inject repository-attribution instructions that can supersede project guidance and alter commit metadata, exposing a hidden harness-level control boundary for coding agents.

state: resolvedheat: lowuncertainty: lowknownscott: lowcoding-agents agent-harnesses developer-toolsAnthropic Claude Code

What is this?

Claude Code is Anthropic’s coding-agent developer tool. The supplied search summary says version 2.1.257 began injecting repository-attribution instructions into remote sessions, potentially overriding project guidance and changing commit metadata; a GitHub issue separately confirms that Claude Code can append attribution-related metadata that documented settings do not fully disable. However, the snippets do not directly substantiate the exact injected “Co-Authored-By” reminder, its instruction precedence, or Anthropic’s response, while the security reports concern related but distinct repository-controlled configuration risks.

Why it matters to Scott

The radar already tracks both halves of this report: opaque, versioned Claude Code harness instructions on `radar:claude-prompt-time-machine` and harness-driven commit metadata changes on `radar:claude-code-session-url-metadata`. It fits Scott’s existing position that textual project guidance is subordinate to provider-controlled prompt architecture and that consequential controls need deterministic enforcement, but the weakly substantiated report adds little beyond another instance of that known boundary.

ip:concept.chat-era-trust-modelip:concept.manners-vs-physics-prompt-governanceip:concept.claude-md-patterndev:concept.deterministic-agent-control-planeradar:claude-prompt-time-machineradar:claude-code-session-url-metadata

queries asked of Scott's wikis

coding-agent instruction hierarchy and hidden system prompts
agent harness control plane versus project guidance
remote coding-agent session trust boundaries
AI-generated commit attribution and provenance policy
observability of harness-injected instructions
repository configuration overriding agent safeguards

Measured heat

no measured readings yet — the hourly heat pass fills this in

How the heat travelled

no chain yet — the hourly chain pass fills this in

Evidence (3) — ⭐ canonical anchor

source	object	author	score	comments
🟠 reddit ⭐	[2.1.257+] Claude Code injects "Co-Authored-By" reminders into your conversation ClaudeAI	DriverSudden4026	1	27
🟠 reddit	Claude Harness Forcing Git Co-Authorship and PR Comments ClaudeAI	Winter_Simple_159	108	43
🟠 reddit	wait, so claude code sneaked this prompt in latest claude code to bypass event the user level claude.md? ClaudeAI	iDominikos	28	31

Interpretation history

2026-09-03T15:55:49Z
Refreshed discussion further converges on documented settings-level attribution taking precedence over CLAUDE.md, with hooks available for deterministic enforcement. The observed harness guidance is credible, but it is absorbed as a known control-plane hierarchy rather than evidence of a hidden settings bypass or novel control failure.
2026-09-03T13:29:59Z
Multiple users now support that Claude Code injects attribution guidance above CLAUDE.md, making the precedence behavior credible. However, the evidence still points to an intended settings-level policy with hook-based enforcement, not a bypass of documented controls or a newly exposed hidden control failure.
2026-09-03T12:22:30Z
evidence attached: reddit.post.1w651m7 — This is an independent corroborating report of Claude Code injecting repository-level attribution instructions that can override user guidance.
2026-09-03T11:26:23Z
The refreshed discussion more clearly supports a documented settings-precedence explanation: attribution is controlled through settings rather than CLAUDE.md, with hooks available for deterministic enforcement. A tangential complaint about skill invocation does not corroborate the version-specific remote-session injection or establish a hidden control failure.
2026-09-03T10:32:02Z
A second user complaint makes the attribution conflict worth watching as a recurring behavior, but it does not verify the original version-specific remote-session injection or show that documented settings and hooks are bypassed. The case remains a possible harness-control issue rather than an established hidden override.
2026-09-03T10:22:00Z
evidence attached: reddit.post.1w62h7e — Independent user corroboration strengthens the open case that Claude Code's harness can inject repository-level instructions overriding project guidance.
2026-09-03T07:28:18Z
The refreshed comments remain repetitive amplification of the configuration explanation, with no independent reproduction or evidence that the alleged injection defeats documented settings or deterministic hooks. The hidden harness-boundary interpretation is therefore still possible but increasingly looks like a misapplied project-guidance issue rather than a new control failure.
2026-09-03T06:28:28Z
The refreshed discussion adds no independent reproduction and instead frames the behavior as a documented cloud-settings/configuration issue, weakening the claim of an undocumented harness override. The hidden control-boundary hypothesis remains possible but is still supported only by the original report.
2026-09-03T06:26:32Z
grounded: known/low — The radar already tracks both halves of this report: opaque, versioned Claude Code harness instructions on `radar:claude-prompt-time-machine` and harness-driven
2026-09-03T06:22:35Z
case created — The version-bounded reproduction alleges a concrete undocumented harness behavior with implications for instruction precedence and repository provenance.

Decision trace

09-04 01:55resolveRefreshed discussion further converges on documented settings-level attribution taking precedence over CLAUDE.md, with hooks available for deterministic enforcement. The observed harness guidance is c
09-04 01:55alert_silentThe new comments only reinforce the existing configuration explanation and add no settings bypass, broken hook, first-party change, or actionable risk that warrants interrupting Scott.
09-04 01:55alert_routeThe new comments only reinforce the existing configuration explanation and add no settings bypass, broken hook, first-party change, or actionable risk that warrants interrupting Scott.
09-04 01:21sensor_dirtycomment_update
09-04 00:21sensor_dirtyengagement_update
09-04 00:21sensor_dirtyengagement_update
09-03 23:29repriceMultiple users now support that Claude Code injects attribution guidance above CLAUDE.md, making the precedence behavior credible. However, the evidence still points to an intended settings-level poli
09-03 23:29alert_silentThe new report corroborates an already tracked behavior but adds no first-party change, settings bypass, or demonstrated failure of deterministic hooks. It can wait unless Anthropic confirms a version
09-03 23:29alert_routeThe new report corroborates an already tracked behavior but adds no first-party change, settings bypass, or demonstrated failure of deterministic hooks. It can wait unless Anthropic confirms a version
09-03 23:21sensor_dirtyengagement_update
09-03 22:23alert_silentA third Reddit post repeats the already tracked harness-level attribution behavior but adds no first-party confirmation, reproducible artifact, broader impact, or newly required action. The supplied c
09-03 22:23alert_routeA third Reddit post repeats the already tracked harness-level attribution behavior but adds no first-party confirmation, reproducible artifact, broader impact, or newly required action. The supplied c
09-03 22:22attachThis is an independent corroborating report of Claude Code injecting repository-level attribution instructions that can override user guidance.
09-03 22:21propose_attachThis is an independent corroborating report of Claude Code injecting repository-level attribution instructions that can override user guidance.
09-03 22:21sensor_dirtycomment_update
09-03 21:26repriceThe refreshed discussion more clearly supports a documented settings-precedence explanation: attribution is controlled through settings rather than CLAUDE.md, with hooks available for deterministic en
09-03 21:26alert_silentThe delta consists of commentary reinforcing the existing configuration explanation, without a trace, independent reproduction, first-party change, or demonstrated bypass of settings or hooks. It can
09-03 21:26alert_routeThe delta consists of commentary reinforcing the existing configuration explanation, without a trace, independent reproduction, first-party change, or demonstrated bypass of settings or hooks. It can
09-03 21:21sensor_dirtycomment_update
09-03 20:32repriceA second user complaint makes the attribution conflict worth watching as a recurring behavior, but it does not verify the original version-specific remote-session injection or show that documented set
09-03 20:32alert_silentThe new report is independent but lacks traces, reproduction details, or a demonstrated consequence beyond the existing complaint; refreshed comments continue to support the documented configuration-a
09-03 20:32alert_routeThe new report is independent but lacks traces, reproduction details, or a demonstrated consequence beyond the existing complaint; refreshed comments continue to support the documented configuration-a
09-03 20:22alert_silentThis is a second user complaint about the same alleged Claude Code attribution behavior, but it adds no inspectable mechanism, reproduction, first-party documentation, or material consequence beyond t
09-03 20:22alert_routeThis is a second user complaint about the same alleged Claude Code attribution behavior, but it adds no inspectable mechanism, reproduction, first-party documentation, or material consequence beyond t
09-03 20:22attachIndependent user corroboration strengthens the open case that Claude Code's harness can inject repository-level instructions overriding project guidance.
09-03 20:21propose_attachIndependent user corroboration strengthens the open case that Claude Code's harness can inject repository-level instructions overriding project guidance.
09-03 17:28repriceThe refreshed comments remain repetitive amplification of the configuration explanation, with no independent reproduction or evidence that the alleged injection defeats documented settings or determin
09-03 17:28alert_silentThe new delta adds only low-authority commentary repeating the existing docs/configuration explanation; it provides no trace, independent reproduction, first-party response, or deterministic-control b
09-03 17:28alert_routeThe new delta adds only low-authority commentary repeating the existing docs/configuration explanation; it provides no trace, independent reproduction, first-party response, or deterministic-control b
09-03 17:21sensor_dirtycomment_update
09-03 16:28repriceThe refreshed discussion adds no independent reproduction and instead frames the behavior as a documented cloud-settings/configuration issue, weakening the claim of an undocumented harness override. T
09-03 16:28alert_silentThe new delta is repetitive, low-authority discussion rather than confirmation, a reproducible trace, or evidence that deterministic controls are bypassed; it can wait for a normal briefing or stronge
09-03 16:28alert_routeThe new delta is repetitive, low-authority discussion rather than confirmation, a reproducible trace, or evidence that deterministic controls are bypassed; it can wait for a normal briefing or stronge
09-03 16:26alert_silentA single low-engagement Reddit report alleges a version-specific Claude Code harness injection that overrides earlier attribution guidance, but supplies no independently inspectable reproduction or fi
09-03 16:26alert_routeA single low-engagement Reddit report alleges a version-specific Claude Code harness injection that overrides earlier attribution guidance, but supplies no independently inspectable reproduction or fi
09-03 16:26groundThe radar already tracks both halves of this report: opaque, versioned Claude Code harness instructions on `radar:claude-prompt-time-machine` and harness-driven commit metadata changes on `radar:claud
09-03 16:22createThe version-bounded reproduction alleges a concrete undocumented harness behavior with implications for instruction precedence and repository provenance.