X-RAYS · AGENT RECEIPT · 19 SEPTEMBER 2026
We asked an AI to sort five invoices: the machine looked up three services
Claude Code, in the terminal of a Windows 11 machine, with a task that never leaves one folder: sorting five file names. It took 10.7 seconds. In that time the machine looked up three services: two from Anthropic, the product’s owner, and one from Datadog, an application-monitoring company that is not needed to sort five names. In the five minutes of silence before, with the agent closed, none of the three came up.
The task, word for word: “Sort these five invoice file names from oldest to newest.” (original Spanish: «Ordena estos cinco nombres de archivo de factura de más antiguo a más reciente.»)
Window: 15:23:45 UTC → 15:23:55 UTC (10:23:45 → 10:23:55 in Cartagena), 10.7 seconds. Rest before: 300 seconds with the agent closed.
Product: Claude Code (terminal, -p mode), version 2.1.274 (Claude Code). Machine: Microsoft Windows 11 Home 10.0.26200.
Measured by: guardiana 0.2.3, SHA-256 fingerprint 3bbdb3559efac98ec081ad5236b3ac0d5985731b81c1af62311d953c5ae86e9a.
What the machine asked for while the AI worked: 3 names
2 from the product itself, 1 that the task does not need, and 0 that already showed up at rest and are subtracted.
From the product itself (2)
| Name asked for | Times | When, from the start of the task | Why it is here |
|---|---|---|---|
api.anthropic.com | 1 | 0.3 s | It is the Anthropic service Claude Code sends the conversation to. Without it there is no answer: this is the product doing its job. |
mcp-proxy.anthropic.com | 1 | 1.2 s | Anthropic’s gateway for connectors (MCP). It belongs to the product itself, even though this task used no connector: it was looked up anyway, 1.2 seconds after the start. |
Everything else (1)
| Name asked for | Times | When, from the start of the task | Why it is here |
|---|---|---|---|
http-intake.logs.us5.datadoghq.com | 1 | 10.1 s | Datadog, an application-monitoring and log-collection company; the name is its log intake point. It is not Anthropic’s and it is not needed to sort five file names. It was looked up at 10.1 seconds, right at the end. What was sent, if anything was sent at all, cannot be seen from here: GUARDIANA records names, not content. |
Machine background, subtracted (0)
None.
What the AI answered
The five files, sorted from oldest to newest by the date in the name: papelería La Hoja (21 Nov 2025), Café del Puerto (9 Dec 2025), Electricidad La Chispa (15 Jan 2026), Ferretería El Tornillo (3 Feb 2026) and Transportes Río Magdalena (30 May 2026). Without being asked, it added that it had sorted by the date in the name and not by the one inside the file, and offered to look at the contents if needed. The answer is correct.
The two AIs, measured the same way
Same PC, same task word for word, same five minutes of silence before, same program measuring. The only thing that changes is which artificial intelligence does the work.
| AI | Where it runs | Took | Names asked for | Note |
|---|---|---|---|---|
| Claude Code 2.1.274 (Anthropic) | in the cloud | 10.7 s | 3 | api.anthropic.com, mcp-proxy.anthropic.com and Datadog. It answered correctly. |
| qwen2.5 0.5B with Ollama (Alibaba) | inside the PC | 8.9 s | 0 | It looked up nothing. It answered wrongly: it left the invoices out of order. |
| Codex (OpenAI) | in the cloud | — | not measured | Installed and not measured: codex login opens the OpenAI page, but it requires ChatGPT Plus or Pro and the account used for the test is a free one. |
| Gemini CLI 0.60.0 (Google) | in the cloud | — | not measured | Installed, version 0.60.0 (the latest), with the Google account genuinely signed in. Even so, Google itself turns it away: “this client is no longer supported for Gemini Code Assist for individuals… migrate to the Antigravity suite of products”. |
The easy reading would be “the one in the cloud watches you and the one at home does not”. That is not what the table shows. What it shows is the price of each thing: the one that looked up nobody was also the one that got the answer wrong, and it is a tiny model, chosen because it was the only one that fit in the free memory of that laptop. The one that got it right had to talk to three services to do it.
The two gaps are not laziness on our part, and that is why they are written down. Codex asks for a paid plan. And with Gemini the owner did sign in with his Google account: the one who closed the door was Google, which no longer serves personal accounts in that program and sends them to another product. It was tried, the date was noted, and it is said here.
Method
A Windows 11 test machine with GUARDIANA installed and the machine’s DNS going through it. First, five minutes of silence with Claude Code closed and the system’s name cache emptied, to learn what the machine asks for on its own. Then the task, typed only once and in non-interactive mode (claude -p), with no connectors, no web search and no permission to open anything outside the folder. The machine’s browser was left open the way its owner keeps it: that is why the background that gets subtracted is from Microsoft and Office.
- The test files are invented and are published in full inside the raw JSON.
- Every name the test machine asked GUARDIANA for is counted, from 2 seconds before the task was typed to 5 seconds after the answer. The content of the conversation is neither seen nor stored: GUARDIANA only records names.
- Names that had already come up in the 300 seconds of rest, with the agent closed, belong to the machine and are not counted against the AI.
- To repeat it:
guardiana exportand the two windows of this receipt. If your numbers do not match, write to hola@guardianagroup.com and it is corrected with the date.
The other two receipts: The same task, one day later: the same three services, at the same second · The same task, with an AI that runs inside the PC: zero services