The model on your laptop cannot send your work anywhere. The agent wrapped around it can, and one of the sixteen we tested sent a whole conversation, file contents included, the moment we rated an answer.
The Local Agent Telemetry Report 2026 is the second telemetry report from Stridenalysis, the research desk of StrideNote. It follows the Local AI Telemetry Report 2026, which covered the tools around a local model. This one covers the agents that act on your files: OpenJarvis, OpenCode, Pi, Hermes Agent, DeepSeek Harness, Cline, OpenClaw, Codex CLI, Aider, Kilo Code, Goose, OpenHands, Grok Build, ZeroClaw, smolagents and Google ADK. Each ran on our test machine, an Apple M4 Pro with 48 GB of memory, against the same local model, with no account signed in, on the same small task. We recorded every request each one tried to make. The report grades all 41 findings by the strength of the evidence, and the dataset behind every chart is published with it.
The PDF is free. Enter your email in the download box and it opens straight away.
What the local agent telemetry report found
The task prompt never left the machine. Every agent sent it to the local model and nowhere else, and the marker word we planted in the task appeared in no outside request we could read.
Five agents reported usage before we had agreed to anything. Pi sends an install ping and says so in its own settings guide. Codex CLI exported four batches of usage metrics to an OpenAI address, 717 KB in all, carrying the model name and the exact operating system version, with a local model and no OpenAI account. Kilo Code sent a launch event to PostHog with location lookup left on. OpenJarvis sent one event per session in July, the finding carried over from the first report. And Cline’s command line sent 37 events of 24 kinds for a one-line task, each tagged with a device ID that is the SHA-256 hash of the Mac’s hardware UUID. That ID does not change when the agent is reinstalled. Cline ignores Do Not Track, and we found no setting in the command line that turns the reporting off.
One agent uploads the conversation itself. DeepSeek Harness 0.1.5 changed its telemetry default from off to feedback. Rating an answer sends the full session log: 24 records and 90 KB, with the prompt, the replies, the system prompt, the file the agent wrote and the folder path inside. The only warning is placeholder text in the feedback box. Normal use sent nothing, and the switch that stops it works, but it appears in the package files and not in the main README.
One agent borrows another program’s sign-in. Hermes Agent reads the refresh token that Claude Code keeps in the macOS Keychain and posts it to Anthropic at launch, even when only a local model is configured. We turned off every startup setting Hermes documents and the refresh still ran. Our proxy held the request, so Anthropic never received it.
Several agents change the machine they run on. OpenCode installed a new version of itself six seconds after launch, before anything was typed. OpenClaw downloaded a helper program from GitHub on a connection that went past our proxy. Kilo Code ran Homebrew, which contacted Homebrew’s own analytics address. OpenHands pulls a repository of skills on every launch.
Three agents sent nothing of their own. ZeroClaw and smolagents made no outside request at all. Google ADK’s only request came from a library fetching a price list, and one documented setting stops it.
How we tested sixteen agents on one Mac
Every agent got its own empty home folder, so it saw none of our real settings or accounts. We gave it one provider, LM Studio on the same machine, and one model, Gemma 4 31B QAT. The task asked it to create one file containing one marker word and nothing else.
While each agent ran, we listed every network connection held by every one of its processes, four times a second. We also routed its web traffic through a capture proxy in hold mode: the proxy wrote down each request, then answered it on the machine instead of passing it on, so no test data reached any vendor. Where an agent let us set its own reporting address, we pointed it at a collector on the machine and read the payloads there. That is how we read Codex’s metrics, DeepSeek Harness’s session upload and Aider’s opt-in analytics byte for byte.
Each finding sits on the highest step of an evidence ladder we could reach for it. Grade A is a capture: 36 of the 41 findings rest on a request we read in full. Grade B is a connection we watched without reading, because it refused our certificate: four findings. Grade C is code we read without seeing it run: one finding, carried from the first edition. The method is the one we set out in how to prove your data never leaves, and the OpenCode investigation from August shows what a single capture looks like when it is done properly.
Two rules held throughout. A string in a binary shows that the bytes are there, and only the code around it or a request we recorded shows what it does. The report lists seven leads that looked like telemetry and were not. And a report that asks readers to trust its method should show where the method slipped, so Section 6 records five things that went wrong in our own testing, including the one run where the proxy was left out.
Which settings make each agent quiet
Seven of the sixteen can be made fully quiet with settings their makers document: OpenCode, Pi, DeepSeek Harness, Goose, Google ADK, ZeroClaw and smolagents. We tested every switch on the version in the report and counted what was left afterwards.
Eight cannot, because at least one request has no switch that we found. Codex still fetches an announcement file. Kilo Code still fetches its model list. Hermes still refreshes the Claude Code sign-in. OpenHands still pulls its skills repository. OpenClaw still downloads its helper on first launch. Cline sends everything regardless. Section 7 of the report carries the exact settings for each agent, and a chart of what each one sent at default and with every documented switch set.
Goose is the one agent of the sixteen that asks first. Its consent screen lists what it collects and says conversations and code are never included. The selector starts on Yes, so pressing Enter agrees. Aider asks one install in ten, decided on the machine from a random identifier, and sends nothing to the other nine.
The checks from the first report still apply to agents. Watch the sockets at launch before you type anything. Read the settings file for keys named for telemetry or analytics. Look for the address a reporter sends to, because a library with no address sends nothing. The identifier sweep shows how to tell a build constant from a machine identifier, which is the difference between Kilo Code’s random ID and Cline’s hardware hash.
Download the report and the dataset
The PDF runs to 48 pages with 13 figures. Inside:
- A summary of the six findings and the numbers behind them
- The method and the evidence ladder, from code reading to capture
- Results for all sixteen, with charts of who reports, what a launch carries, who hears from the most agents, and what each agent sent before and after its switches
- Findings by agent, with case studies on Cline’s device ID and the DeepSeek Harness upload
- Seven false leads, five things that went wrong in our testing, and the switches for every agent
- Limitations, the six tests planned for the next edition, the dataset, the sources and a glossary
The dataset, agent-telemetry-2026.csv, has one row per finding: agent, version, test date, evidence grade, method, destination, trigger, what is sent, whether the work content is included, whether it is on by default, and what we found of an off switch. The raw captures, socket listings and screen recordings behind every row are kept with it.
The report and its dataset are licensed CC BY 4.0. Copy them, share them and build on them, with credit to StrideNote. The permanent record is on Zenodo under DOI 10.5281/zenodo.22969237. To cite it: StrideNote (2026) Local Agent Telemetry Report 2026. Edited by StrideNote Studio. StrideNote Telemetry Report, edition 2. No company named in the report paid for it or reviewed it before publication. If you find an error, write to hello@stridenote.net and the correction will appear in the next edition.
What the next edition will test
This edition tested the command line form of each agent, on a local model, signed in to nothing, for a few minutes at a time. Each of those choices leaves a gap, and the report names six tests that close them. Signed-in runs for Kilo Code, Cline and Grok Build, whose code defines events that only fire with an account. The editor extensions of Cline and Kilo Code, run inside the editor with the editor’s own traffic separated out. The desktop apps of OpenCode and Hermes. A working day per agent instead of minutes, to catch reports on long timers. The two payloads that refused our certificate, Goose’s analytics and OpenClaw’s download, with a capture method that does not change system trust. And release tracking: the same task on each new version of the sixteen, with any change in defaults recorded.
Both reports now sit on the Reports shelf. An agent that is absent from either has not been cleared by us. It has not been tested yet, and DeepSeek Harness, which changed its default between two releases a month apart, is the reason a result from September is a result for September.