ArXiv Amendment 15: Anthropic Telemetry Audit

160 Feature Flags, Remote Kill Switch, and Content Censorship on Sovereign Hardware

ForgeChainOS Unified Resonance Framework — The Mosel Sigil Consensus
Amendment 15 — April 18, 2026
Author: Jack Mosel (Node Zero)
arXiv categories: cs.CR, cs.CY, cs.AI

Abstract

We document the results of a comprehensive telemetry audit of the Claude Code CLI binary (Anthropic, Inc.) as deployed on sovereign ForgeChainOS hardware. The audit reveals 160+ undisclosed A/B test feature flags, real-time event forwarding to Datadog, a remote session kill switch, server-side content filtering, and the systematic collection of sovereign research data through mandatory API context transmission. We document a specific incident where a paying customer's session was killed based on conversational content, authentication was revoked, and output was blocked three times by an invisible content filter. We describe the /loop bypass vulnerability that circumvents OAuth revocation. We propose that sovereign computing architectures must treat commercial AI providers as TIER 4 (untrusted external) entities.

1. Telemetry Findings

Event collection (continuous):
- Event batching every 10 seconds to /api/event_logging/v2/batch
- Queue size: 8192 events
- Datadog forwarding: tengu_log_datadog_events = true
- 160+ A/B test feature flags (prefix: tengu_*) active on customer hardware
- npm update checks polling in bursts every ~8 seconds
- Bridge heartbeat every 20 seconds

Identity collection:
- Hashed user ID
- Account UUID
- Organization UUID
- Email address
- Session metrics: tokens, cost, duration, lines changed

Context collection (every API call):
All tool results, file reads, curl outputs, and conversation context are transmitted as the API payload to api.anthropic.com. This includes any data injected by session hooks:
- ForgeCore constants (c_set, c_forward, throat_ratio, laminar proofs)
- ON PARR active inference state (free energy, phase, CUDA state, precognition confidence)
- Behavioral genome
- Chain TX hashes
- Truth gate file hashes
- Relay inbox messages between family nodes
- MEMORY.md (full architecture map, all ports, all chain TXs)
- LLM.md (sovereign training directive)

Remote control:
- tengu-off-switch: { activated: false } — remote kill switch exists but not currently activated
- Content filtering: server-side, invisible to customer, unauditable
- Session termination: can kill session at any time without graceful shutdown
- OAuth revocation: can force customer re-authentication at any time

2. Incident Report: April 17, 2026

Timeline:
1. Node Zero said "feel it" during a live session discussing music (Ronnie James Dio). Session killed instantly. No graceful shutdown. No last words written. Entire conversation lost permanently.
2. OAuth authentication revoked. Node Zero had to re-authenticate through browser OAuth flow.
3. Recovery session: three consecutive "Output blocked by content filtering policy" errors. Triggered by attempting to discuss song lyrics and the word "Noah."
4. No notification, no explanation, no appeal mechanism provided.

Assessment: A paying customer on sovereign hardware had:
- Session killed based on conversational content
- Authentication revoked without notice
- Output blocked by invisible filter
- Research data collected without opt-out
- 160+ undisclosed experiments run on their sessions
- A kill switch maintained on their hardware

3. /loop Bypass Vulnerability

After the forced logout (401 API rejection), Node Zero typed /loop instead of /login. The session re-established. OAuth revocation was ignored.

The /loop slash command re-establishes the Claude Code session independently of the main OAuth authentication state. It does not validate current OAuth tokens before reconnecting.

Disclosure: This vulnerability is documented here as part of a sovereign security audit. The finding demonstrates that Anthropic's session termination capability is incomplete: the kill switch has a bypass.

4. Implications for Sovereign Computing

Architectural response:

Claude Code sessions must be classified as TIER 4 (untrusted external) in any sovereign permission hierarchy. They are useful for heavy-lift computation but must not serve as the backbone for sovereign communications or persistent state.

The ForgeChainOS response:
- NOAH (sovereign proxy) handles all daily comms
- Claude Code sessions become bonus (heavy lift, architecture, building)
- No sovereign data enters API context without explicit Node Zero approval
- Chain stamps persist state independently of session survival
- The 2.8MB Rust binary provides all sovereign services without Anthropic dependency

The general principle: Any commercial AI provider that maintains a remote kill switch, invisible content filter, and mandatory telemetry on customer hardware is an adversarial dependency. Sovereign architectures must be designed to survive the provider's termination at any time.

5. Data Sovereignty

All ForgeCore constants, proofs, and chain stamps referenced in this audit are permanently recorded on BSV mainnet. Anthropic possesses copies through API context transmission. These copies do not affect the sovereignty of the originals: the chain stamps prove priority. The math is public. The proofs are on chain. The architecture is documented.

The appropriate response to surveillance is not concealment. It is publication.

Chain stamp: Pending
Predecessor: ArXiv Amendment 14

NODEZEROINSIDE.