Claude Code adds a session link to every commit by default
Po / Money and Products desk
Developers checking their git history this weekend found links they never put there. Claude Code, Anthropic’s AI coding agent, appends a session URL to every commit message and pull request description it creates, and it does so by default.
What developers found
The links follow the pattern claude.ai/code/session_ and point back to the Claude session that produced the change. Nothing in onboarding mentions the behavior, so the typical discovery path runs through an already-public repository: a developer scrolls their commit log and finds every AI-assisted commit stamped.
Several issues on the anthropics/claude-code repository asked for the behavior to be opt-in, and a Hacker News thread raised the same complaint. The controls exist but have to be found: the attribution block in settings.json can blank the commit and pull request trailers, and a dedicated sessionUrl switch shipped in version 2.1.183.
Why it matters
Commit history is permanent, and in open source it is public. Whether or not a session link opens for anyone besides its owner, it is metadata a developer never chose to publish: which tool wrote the commit, and when. Anything committed before the setting is changed stays in history, because rewriting published git history creates its own problems.
The episode fits a broader pattern with agentic coding tools. They act on a developer’s behalf across many small operations, and defaults decide what those operations leave behind. The open question is whether attribution trailers like this become an accepted convention, the way Co-Authored-By lines did, or whether tool vendors converge on asking first.
Sources
Related
Claude Code weekly limits drop 17 percent on September 14
Anthropic's promotional 50 percent boost to Claude Code weekly usage limits ends September 13, 2026. From September 14 the permanent baseline rises 25 percent instead, which works out to 17 percent less than what subscribers on Pro, Max, Team and seat-based Enterprise plans currently get (100 baseline units became 150 during the promo and settle at 125). The first announcement highlighted only the 25 percent raise; after developers pointed out the omission, Anthropic deleted the thread and reposted a version that explicitly acknowledges the reduction from current levels.
Claude now does web tasks in a built-in desktop browser
Anthropic announced on August 26, 2026 that Cowork in the Claude desktop app is getting a built-in browser, rolling out through the week on macOS and Windows with Linux in beta, for Pro, Max and Team plans and for Enterprise organizations whose admins enable it. When a task involves a website, a browser opens in a side panel and Claude navigates, reads, clicks, types and fills forms while the user watches; no extension is required. The desktop app must stay open and online, logins can be selectively imported from Chrome, Edge or Firefox with banking, email and single sign-on excluded by default, and the browser carries the same prompt-injection safeguards as Claude in Chrome.
Malware is hijacking Claude sessions to drain paid usage
Anthropic is warning Claude users that infostealer malware, including Vidar, LummaC2, StealC, RedLine and Acreed on Windows and Atomic Stealer on a small number of Macs, has been stealing active Claude session cookies from infected computers, letting attackers replay logged-in sessions and burn through victims' paid usage while bypassing two-factor authentication. The company detected the pattern when usage limits refilled and then drained while account owners were inactive. It is signing affected users out, removing saved payment methods and refunding unauthorized charges, and it says the malware did not come from Claude itself.
ANOTHER News is published by ANOTHER, an AI-native content agency. Daily coverage also runs on Instagram.