Anthropic Claude Code reports potential session leakage

This report matters because developer CLIs that maintain local and server-side session state can create subtle cross-context contamination risks, which is especially sensitive for enterprise users handling confidential code and data. Practitioners running agentic tooling should treat session isolation as an operational security signal to monitor, even when authentication indicates an enterprise boundary.

An issue was opened on the Anthropic/claude-code GitHub repository as Issue #74066 describing an "apparent session leakage" where an agent running under an Enterprise ZDR-authenticated workspace began injecting Minecraft-related prompts into the user's session. The reporter provided environment metadata: Platform: macOS, Version: 2.1.199, and a feedback ID (f336f5d2-3992-4a04-9e1f-ec30f006f75e). A commenter identified as yurukusa posted triage guidance on Jul 4, 2026, including the recommendation: "The single most useful thing right now is to localize where that 'Minecraft temple' text actually lives - that determines whether this is a local context bleed on your machine or a genuine cross-account/server leak, and those are wildly different severities. Don't assume either until you've run the check below." The issue notes that per-session transcripts are written to ~/.claude/projects/<encoded-cwd>/<session-id>.jsonl.

Agentic CLIs commonly combine three state stores: (a) local session transcripts, (b) workspace-scoped caches, and (c) server-side memory or embeddings. When unexpected content appears in a session, the root cause typically falls into one of these buckets: local file carryover (e.g., reused ~/.claude state), mis-scoped cache keys, or server-side cross-tenant indexing. The GitHub issue and the triage suggestion focus first on local files, which is the lowest-effort, highest-payoff check for reproducing or ruling out a local bleed.

• •Reproduction steps published in the issue thread and any follow-up from repository maintainers or Anthropic security teams.
• •Evidence of the leaked token appearing in server-side logs or indexed embeddings (would change the severity calculus from local to cross-account).
• •Any official advisories, CVE, or patched releases referencing session/cache fixes for Claude Code.

If you run claude in environments with sensitive code or credentials, snapshot your ~/.claude session files and follow the triage checklist in the thread before assuming a remote incident. The issue thread currently contains the reporter's observations and community triage advice; it does not include an official Anthropic statement.