A markdown file sat in a developer’s working directory, unread, because a server in San Francisco had not answered a question about whether it should be read. The file was AGENTS.md. The question was a Statsig feature flag called tengu_agents_md_mod. The developer had turned telemetry off, so the question never got asked, the flag defaulted to false, and Claude Code started the session, answered normally, and never mentioned that it had skipped the project’s instructions.

That bug was reported, reproduced, front-paged and fixed inside about five hours. The fix is the part with no paper trail.

The reproduction, in the order it was run

Paweł Szypowicz published his measurements on 23 September and cross-posted them to the open issue. The test is four lines, and it is worth reading because of one detail in the middle.

  1. Make an empty directory holding nothing but an AGENTS.md with a canary word in it: echo 'The canary word is PERIWINKLE.' > AGENTS.md.
  2. Ask for the word without letting the model cheat by reading files: claude -p 'What is the canary word from the project instructions? Answer NONE if you have none. Do not read files.'
  3. Run every configuration twice. In his words: “Each setup ran in two sessions, because the first session in a new configuration only fetches the flag and the second one uses it.” A single-session test of this bug returns the wrong answer on a correct build, which is a good way to spend an afternoon fixing nothing.
  4. Read the answer. NONE means the file on disk was never handed to the model.

What came back:

  • CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 blocks it, as the issue said.
  • DISABLE_TELEMETRY=1 blocks it too. Both had to be cleared.
  • Setting either variable to 0 does not help. Anthropic’s own documentation is explicit about why: CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC is presence-based, and “setting it to 0 or false still disables this traffic”. Presence-based opt-outs are a defensible privacy default and a trap when you are trying to turn something back on.
  • A project’s .claude/settings.json clearing both variables has no effect. There was no per-repository escape.
  • A session-level override works, from the second session onward.

None of these cases printed a warning. That is the whole defect. A silent skip of a project instruction file is not a missing feature; it is the agent operating under a different contract than the repository specified, with no signal to the operator.

Where the gate lived

The loader ships as a built-in plugin, and its registration in the 2.1.280 bundle is three lines:

var W = !1;
var B = () => Oa("tengu_agents_md_mod", W);

W is isOnByDefault, and it is false. B is isAvailable, asking a remote flag with false as the fallback. So a local file read that requires no network at all waited on a network call — and when the network call was suppressed by a privacy setting, the answer was no.

The reporter’s framing in the issue is the sharpest line written about it: reading a local markdown file, “an act that requires no network whatsoever, is silently locked away by a server-side switch.”

The response, and the one word in it that matters

An Anthropic engineer replied on the thread under the handle mpoteat, and the reply is unusually direct for a vendor: “this is a rollout artifact, we needed a way to turn this off remotely via feature flags if it broke something, and with telemetry off you don’t get those. It’s already been fixed as part of v2.1.281 releasing today.” Then: “this was a fully human error on my part — I should’ve found a better way to launch with a kill-switch.”

That is a real explanation rather than a deflection, and it is worth crediting as one. The kill-switch motive is sound engineering: you do not ship a change to instruction-file loading, the most load-bearing context in the tool, without a way to turn it off from outside. The error was in what the kill switch was wired to.

The timeline supports the claim. The HN submission is timestamped 23 September 12:15 UTC. npm has 2.1.281 published at 17:01 UTC the same day. Just under five hours from front page to shipped fix.

What is not written down

Here is where it stops being a good story.

Search the Claude Code changelog for AGENTS and you get exactly one hit, in 2.1.277: the release that added the feature. The 2.1.281 entry — 30-odd lines of gateway, proxy and session-resume fixes — does not mention AGENTS.md, the flag, or the gate. Neither does 2.1.282. A release that fixed a silent instruction-skip does not say so in the file people read to find out what changed.

The written record instead lives in two places. The documentation carries it as a line inside a subsection on unavailability: “Before v2.1.281, some sessions, such as those on Amazon Bedrock or with telemetry disabled, read CLAUDE.md files only. On those versions, update Claude Code.” True, complete, and findable only by someone who already suspects there was a problem. And the Hacker News comment, which is the most informative account of the incident in existence and is not a document Anthropic controls.

Issue #95690 was still open when this was written, last updated 23 September, four comments, no maintainer reply on the thread itself. The fix landed in a release; the report of it is a reply in someone else’s forum.

The gate is gone, the class of gate is not

The same documentation page that dates the fix also lists what still needs a fetched feature flag, and the list runs to fifteen items: auto mode on Pro, Max and Team plans; Remote Control; claude import; /skill-doctor; syncing your claude.ai skills and plugins; the advisor tool; artifact comments; whether a large paste is treated as pasted or typed. Turn telemetry off, or run on Bedrock, Vertex, Foundry or a gateway, and none of those arrive.

Most of that list is fine. Remote Control genuinely needs a server. Syncing account-level skills genuinely needs an account call. The AGENTS.md case was different in kind, not in degree: it was the only one where a purely local operation, on a file the user had already written and committed, was conditioned on a remote answer — and where failing closed meant silently doing something other than what the repository asked.

So the correct reading is not that the flag system is dangerous. It is that “can this feature reach a server” and “should this feature run” are two different questions, and the second one was answered with the first. One instance of that mistake has been fixed. The list of fifteen is worth re-reading with the question in mind.

The remaining gap is smaller and still open: there is no warning. If a future build skips an AGENTS.md for any of the reasons still on the list — a disabled plugin, a first session after upgrade, a CLAUDE.local.md a colleague added — the session starts, the model answers, and nothing says a file was skipped. The reporter asked for exactly that and it is the one thing 2.1.281 did not ship: “a startup warning when an AGENTS.md is present and skipped would save people the time I spent on a canary test.”

Disclosure: Claude Code is part of the toolchain used to produce this site.