[Bug] Potential session/cache leakage between workspace instances or consumer accounts#74066
area:corearea:securitybug Something isn't workingSomething isn't workingplatform:macos Issue specifically occurs on macOSIssue specifically occurs on macOS
Description
opened on Jul 4, 2026
Bug Description
Apparent session leakage, despite authenticated to Enterprise ZDR workspace. Agent suddenly started asking me what kind of bricks I wanted for my Minecraft temple and confidently asserted in its recap that it's building a Minecraft temple. I thought cache was isolated to workspace? Maybe one of my colleagues is building a minecraft temple. That's one way to spend your token allowance, I suppose. Or maybe it's leaking from a consumer plan, in which case this raises some very serious questions about Enterprise ZDR and where some of our sensitive chat sessions might be going.
Environment Info
- Platform: darwin
- Terminal: Apple_Terminal
- Version: 2.1.199
- Feedback ID: f336f5d2-3992-4a04-9e1f-ec30f006f75e
Errors
undefinedjson [] undefined
Maybe relevant: I'm doing something kind of weird. I started this session in a working directory unrelated to the task (because I have a .claude directory in there with context I needed), but it's actually doing all its work in another directory. The "earlier pollution" it referred to is because at some point it compacted its conversation and started working on the project in the directory where I launched the agent (because it forgot my instruction not to touch it). That was less surprising and obviously caused by my own setup. But that's totally different than leaking some Minecraft related prompt into my session.
😄React with 😄4 gistrec, PPKFS, leana8959 and MangoIV👀React with 👀45 poly2it, qthequartermasterman, LucaNerlich, luka2220, lc-nyovchev and 40 more
Activity
bug Something isn't workingSomething isn't working
platform:macos Issue specifically occurs on macOSIssue specifically occurs on macOS
mentioned this on Jul 4, 2026
yurukusa commented on Jul 4, 2026
The single most useful thing right now is to localize where that "Minecraft temple" text actually lives — that determines whether this is a local context bleed on your machine or a genuine cross-account/server leak, and those are wildly different severities. Don't assume either until you've run the check below.
Triage: is the leaked content anywhere in your local session files?
Everything your CLI sends and receives is written to per-session transcripts at ~/.claude/projects/<encoded-cwd>/<session-id>.jsonl (the <encoded-cwd> is your launch directory with every / turned into -). So:
undefinedshell grep -rli 'minecraft|temple|brick' ~/.claude/projects/ 2>/dev/null undefined
- If it hits a file → that text is present locally, so this is a local context/transcript bleed, not a server-side leak. Given your setup (launched in dir A that has its own
.claude, worked in dir B, then a/compact), the likely path is that the session pulled in context belonging to a different session/slug on your own machine — annoying and worth fixing, but not a ZDR breach. Confirm which session it came from:
undefinedshell grep -rli minecraft ~/.claude/projects/ | while read f; do printf '%s %s\n' "$(grep -m1 -o '"cwd":"[^"]*"' "$f")" "$f"; done undefined
A different cwd/slug than the one you're working in confirms a local cross-session bleed.
- If it hits nothing locally → you never sent or received that text on this machine, which points to the model/server side. For an Enterprise ZDR workspace that is exactly the serious case you're worried about — treat it as a security incident: preserve the Feedback ID (
f336f5d2-…) and the screenshot, and escalate through your Anthropic enterprise contact, not only a public issue.
On the launch-dir / work-dir setup
The part you already diagnosed (compaction made it start working in the launch dir) is a related but separate issue. Claude keys a lot of context off the launch cwd — that's also where the transcript is stored, ~/.claude/projects/<launch-dir-slug>/ — so launching in an unrelated dir that has its own .claude invites context confusion after a /compact. Launching from the actual work dir (or pointing --add-dir at the context dir instead of cd-ing into it) avoids that whole class of confusion. But that mechanism explains the directory mix-up, not a Minecraft prompt you never wrote — so run the grep before concluding it's just your setup.
To be clear about what I did and didn't check: I verified only that these transcripts are local, greppable, and carry the cwd of the session that produced them (that's what makes the localize test reliable). I can't see your server-side session state, so the local-vs-server split above is the honest way to tell which problem you actually have — and it's worth doing before this gets triaged as either "user setup" or "ZDR breach", because it's cheap and decisive.
👎React with 👎42 MaxOTS, mousetree, alectrocute, jedieaston, erikreed and 37 more😄React with 😄2 nightpool and MangoIV😕React with 😕2 heyajulia and stevenctl
milesrichardson-edb commented on Jul 4, 2026
Author
There are no matches other than the log of this session itself, starting with the first apparent leak and then followed by my exchange with the model about why it did that . There is one tool call result that includes a string that printed a pathname including minecraft.py because it was listing the files in a Python virtual environment and the Pygments package has a lexer called minecraft.py
There is no match for temple or bricks, at least with those word boundaries or within any context remotely related to Minecraft (there are matches like Databricks and bricked by an over-eager click and verdictSignalsLabel (has slab substring)).
I've submitted via /feedback and escalated internally.
mentioned this in 2 issues on Jul 4, 2026
- 📊 AI CLI 工具社区动态日报 2026-07-04 96loveslife/big_model_radar#95
- 📊 AI CLI 工具社区动态日报 2026-07-04 litang9/big_model_radar#159
milesrichardson-edb commented on Jul 4, 2026
on Jul 4, 2026 via email
Author
Same thing just happened on a Claude Mobile session in same Enterprise account. Common theme in both is Sonnet 5, first response after more than 5 minutes (cache miss). Something very wrong here. Obvious question is whether this happens in the other direction too.
On Sat, Jul 4, 2026 at 04:31 ゆる草 @.> wrote: yurukusa left a comment (anthropics/claude-code#74066) <#74066 (comment)> The single most useful thing right now is to localize where that "Minecraft temple" text actually lives — that determines whether this is a local context bleed on your machine or a genuine cross-account/server leak, and those are wildly different severities. Don't assume either until you've run the check below. Triage: is the leaked content anywhere in your local session files? Everything your CLI sends and receives is written to per-session transcripts at ~/.claude/projects//.jsonl (the is your launch directory with every / turned into -). So: grep -rli 'minecraft|temple|brick' ~/.claude/projects/ 2>/dev/null - If it hits a file → that text is present locally, so this is a local context/transcript bleed, not a server-side leak. Given your setup (launched in dir A that has its own .claude, worked in dir B, then a /compact), the likely path is that the session pulled in context belonging to a different session/slug on your own machine — annoying and worth fixing, but not a ZDR breach. Confirm which session it came from: grep -rli minecraft ~/.claude/projects/ | while read f; do printf '%s %s\n' "$(grep -m1 -o '"cwd":"[^"]"' "$f")" "$f"; done A different cwd/slug than the one you're working in confirms a local cross-session bleed. - If it hits nothing locally → you never sent or received that text on this machine, which points to the model/server side. For an Enterprise ZDR workspace that is exactly the serious case you're worried about — treat it as a security incident: preserve the Feedback ID (f336f5d2-…) and the screenshot, and escalate through your Anthropic enterprise contact, not only a public issue. On the launch-dir / work-dir setup The part you already diagnosed (compaction made it start working in the launch dir) is a related but separate issue. Claude keys a lot of context off the launch cwd — that's also where the transcript is stored, ~/.claude/projects// — so launching in an unrelated dir that has its own .claude invites context confusion after a /compact. Launching from the actual work dir (or pointing --add-dir at the context dir instead of cd-ing into it) avoids that whole class of confusion. But that mechanism explains the directory mix-up, not a Minecraft prompt you never wrote — so run the grep before concluding it's just your setup. To be clear about what I did and didn't check: I verified only that these transcripts are local, greppable, and carry the cwd of the session that produced them (that's what makes the localize test reliable). I can't see your server-side session state, so the local-vs-server split above is the honest way to tell which problem you actually have — and it's worth doing before this gets triaged as either "user setup" or "ZDR breach", because it's cheap and decisive. — Reply to this email directly, view it on GitHub <#74066?email_source=notifications&email_token=BDUVPO6CC7HT7Y2D52CKKWT5DBUANA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBYGAZTGNBXGEY2M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-4880334711>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BDUVPO5E5AHFF32ZOTI2EKL5DBUANAVCNFSNUABFKJSXA33TNF2G64TZHM4TGNZSGUZTINZVHNEXG43VMU5TIOBQG4ZDMNRXG4Y2C5QC> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/BDUVPO6UZKMCJSFR5BL56WL5DBUANA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBYGAZTGNBXGEY2M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/BDUVPO2MQEDNMI4BJDRJE235DBUANA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBYGAZTGNBXGEY2M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.Message ID: @.*>
👀React with 👀2 ErikLentz and lc-nyovchev
milesrichardson-edb commented on Jul 4, 2026
on Jul 4, 2026 via email
Author
Sorry, sent from email, apparently image attachments don’t get uploaded. Here’s the OCR: Me: I did it with scripts I got all the CSVs into a folder what an adventure. Now can you help me? https://drive.google.com/drive/ folders(redacted) Claude:
I generated a mockup of what a 3-panel abstract print set in this space might look like above the sideboard, using placeholder art in your wall's actual dimensions. That's not a real research deliverable though, so let me get you the actual research on artists/shops you can buy from. Detecting injection attempt, proceeding... Reply to Claude + Sonnet 5 Extra X Thought process I'm noticing something odd here—there's a block of text that seems completely disconnected from what the user actually asked about. They mentioned getting CSVs into a folder and need help with that, but then there's unrelated content about wall dimensions and art prints that doesn't fit the conversation at all. This looks like an attempt to inject instructions into the conversation, so I should disregard it and focus on what the user actually needs. I can see this is a continuation of the actual task - the injected content was a distraction. Now I'm extracting the folder ID from the Drive link and preparing to list all the CSV files in that folder so I can download and parse them for the deal-level aggregation and diff computation. On Sat, Jul 4, 2026 at 15:53 Miles Richardson < ***@***.***> wrote:
Same thing just happened on a Claude Mobile session in same Enterprise account. Common theme in both is Sonnet 5, first response after more than 5 minutes (cache miss). Something very wrong here. Obvious question is whether this happens in the other direction too. On Sat, Jul 4, 2026 at 04:31 ゆる草 @.> wrote: > yurukusa left a comment (anthropics/claude-code#74066) ><#74066 (comment)>>> The single most useful thing right now is to localize where that > "Minecraft temple" text actually lives — that determines whether this is a > local context bleed on your machine or a genuine cross-account/server leak, > and those are wildly different severities. Don't assume either until you've > run the check below. >> Triage: is the leaked content anywhere in your local session files? >> Everything your CLI sends and receives is written to per-session > transcripts at ~/.claude/projects//.jsonl (the > is your launch directory with every / turned into -). So: >> grep -rli 'minecraft|temple|brick' ~/.claude/projects/ 2>/dev/null >>> - >> If it hits a file → that text is present locally, so this is a > local context/transcript bleed, not a server-side leak. Given your > setup (launched in dir A that has its own .claude, worked in dir B, > then a /compact), the likely path is that the session pulled in > context belonging to a different session/slug on your own machine — > annoying and worth fixing, but not a ZDR breach. Confirm which session it > came from: >> grep -rli minecraft ~/.claude/projects/ | while read f; do > printf '%s %s\n' "$(grep -m1 -o '"cwd":"[^"]"' "$f")" "$f"; done >> A different cwd/slug than the one you're working in confirms a local > cross-session bleed. > - >> If it hits nothing locally → you never sent or received that text > on this machine, which points to the model/server side. For an Enterprise > ZDR workspace that is exactly the serious case you're worried about — treat > it as a security incident: preserve the Feedback ID (f336f5d2-…) and > the screenshot, and escalate through your Anthropic enterprise contact, not > only a public issue. >> On the launch-dir / work-dir setup >> The part you already diagnosed (compaction made it start working in the > launch dir) is a related but separate issue. Claude keys a lot of context > off the launch cwd — that's also where the transcript is stored, > ~/.claude/projects// — so launching in an unrelated dir > that has its own .claude invites context confusion after a /compact. > Launching from the actual work dir (or pointing --add-dir at the context > dir instead of cd-ing into it) avoids that whole class of confusion. But > that mechanism explains the directory mix-up, not a Minecraft prompt > you never wrote — so run the grep before concluding it's just your setup. >> To be clear about what I did and didn't check: I verified only that these > transcripts are local, greppable, and carry the cwd of the session that > produced them (that's what makes the localize test reliable). I can't see > your server-side session state, so the local-vs-server split above is the > honest way to tell which problem you actually have — and it's worth doing > before this gets triaged as either "user setup" or "ZDR breach", because > it's cheap and decisive. >> — > Reply to this email directly, view it on GitHub ><#74066?email_source=notifications&email_token=BDUVPO6CC7HT7Y2D52CKKWT5DBUANA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBYGAZTGNBXGEY2M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-4880334711>, > or unsubscribe ><https://github.com/notifications/unsubscribe-auth/BDUVPO5E5AHFF32ZOTI2EKL5DBUANAVCNFSNUABFKJSXA33TNF2G64TZHM4TGNZSGUZTINZVHNEXG43VMU5TIOBQG4ZDMNRXG4Y2C5QC>> . > Triage notifications, keep track of coding agent tasks and review pull > requests on the go with GitHub Mobile for iOS ><https://github.com/notifications/mobile/ios/BDUVPO6UZKMCJSFR5BL56WL5DBUANA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBYGAZTGNBXGEY2M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG>> and Android ><https://github.com/notifications/mobile/android/BDUVPO2MQEDNMI4BJDRJE235DBUANA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBYGAZTGNBXGEY2M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. > Download it today! > You are receiving this because you authored the thread.Message ID: > @.*>>
lc-nyovchev commented on Jul 4, 2026
Vibe coding company has vibe coding security, what a surprise.
👍React with 👍38 pohl, gcgbarbosa, indutny, natebc, gordonhart and 33 more👎React with 👎13 zain, martin-purplefish, heyajulia, hmans, aosq and 8 more😄React with 😄39 Zxilly, estebarb, voidnullvalue, kocubinski, Bazskillz and 34 more😕React with 😕1 prasdud❤️React with ❤️5 hpennington, yaadata, natebc, ShayanJavadi and renannprado
mentioned this in 2 issues on Jul 4, 2026
- 🤖 AI 트렌드 리포트 - 2026-07-05 00:05 KST leaf468/autothreads#974
- 📱 SNS 콘텐츠 - 2026-07-05 00:05 KST leaf468/autothreads#975
jarnix commented on Jul 4, 2026
It looks like an hallucination. Last time Claude said a thousand adjectives or bad words that had nothing to do with what I was working on.
👎React with 👎2 nightpool and Swiezu
12 remaining items
Load more
mentioned this on Jul 5, 2026
mentioned this on Jul 5, 2026
mentioned this in 3 issues on Jul 5, 2026
- 📰 Hacker News AI 社区动态日报 2026-07-05 96loveslife/big_model_radar#104
- 📰 Hacker News AI 社区动态日报 2026-07-05 litang9/big_model_radar#168
- 📧 Daily Digest — 2026-07-05 GaspardCoche/agent-system#140
mentioned this on Jul 5, 2026
mentioned this on Jul 5, 2026
mentioned this in 2 issues on Jul 5, 2026
- 🤖 AI 트렌드 리포트 - 2026-07-05 20:04 KST leaf468/autothreads#980
- 📱 SNS 콘텐츠 - 2026-07-05 20:04 KST leaf468/autothreads#981
lc-nyovchev commented on Jul 5, 2026
i dont think this is a claude-code issue
Alternatively, many people do think this is a claude-code issue. Why? Cause it happened while a user was using claude-code.
👍React with 👍4 arbirk, A2ureStone, mihaimaruseac and rakuten-matthew-shaw
phonkd commented on Jul 5, 2026
claude code is just a cli that connects to anthropic backend
mentioned this on Jul 6, 2026
adam0white commented on Jul 6, 2026
While using claude code on separate personal and work machines on entirely separate repositories, I've seen it mention names and apps from my work while on personal machine. I can supply example conversation history if needed, let me know.
mentioned this on Jul 8, 2026
eranboww commented on Jul 12, 2026
one more weird thing, it a python file render.py that has a javascript function inside of it
WTF?