Anthropic Claude Code reports potential session leakage
For practitioners, a reported session or cache leak in a developer-facing CLI raises data-isolation and tenant-security questions for agentic tooling, especially since the underlying cause remains unconfirmed rather than settled. A GitHub issue on Anthropic's claude-code repository (Issue #74066) describes an "apparent session leakage" in which an Enterprise ZDR-authenticated session unexpectedly referenced Minecraft, reported on macOS with Claude Code v2.1.199. The report drew real scrutiny: it reached 123 points and 45 comments on Hacker News, where commenters proposed competing explanations rather than converging on "leak." One pointed to a directory listing in the session that had surfaced a Pygments syntax-highlighting file literally named minecraft.py as a likely benign cause, while another user described an apparently similar incident on a separate Claude Mobile session under the same Enterprise account. A repository commenter, yurukusa, urged localizing the source of the text before assuming either a local bleed or a genuine cross-account or server-side leak. Neither Anthropic nor the repository maintainers have issued an official statement.
Editorial analysis
Developer CLIs that combine local session transcripts, workspace-scoped caches, and server-side memory create a genuine attack surface for cross-context contamination, which matters most for enterprise users who assume Zero Data Retention (ZDR) means strict tenant isolation. This report is a useful case study in how to triage that risk rather than assume the worst: the same thread that keeps the leak theory alive also surfaces a plausible, mundane explanation, and practitioners should weigh both before treating an anomaly as a confirmed breach.
What happened
An issue on the Anthropic/claude-code GitHub repository, Issue #74066, describes an "apparent session leakage" in which an agent running under an Enterprise ZDR-authenticated workspace began asking the user what kind of bricks they wanted for a Minecraft temple and asserted it was building one. The reporter, posting as milesrichardson-edb, listed environment details: Platform darwin, Terminal Apple_Terminal, Claude Code version 2.1.199, and feedback ID f336f5d2-3992-4a04-9e1f-ec30f006f75e. The reporter separately noted an unrelated instance of "earlier pollution" in the same session, which they attributed to their own working-directory setup rather than to any leak.
Independent scrutiny
The issue was submitted to Hacker News and drew substantive engagement rather than passing unnoticed, reaching 123 points and 45 comments. Commenters proposed several competing explanations. One noted that a tool call in the session had printed a directory listing containing a file named minecraft.py, the actual filename of a Pygments syntax-highlighting lexer, and argued the model may have latched onto that string rather than pulled in another user's content. Others raised the general possibility of hallucination in a long-context session, or a cache-key bug that could allow prefix-sharing bleed between sessions without constituting a broad server-side leak. Weighing against a pure-coincidence reading, one commenter reported an apparently similar incident on a separate Claude Mobile session under the same Enterprise account, describing a common pattern in both cases: the first response after an idle period of several minutes, consistent with a cache miss. A repository commenter, yurukusa, urged localizing where the text originated before assuming either a local bleed or a genuine cross-account or server-side leak, pointing to per-session transcripts stored at ~/.claude/projects/<encoded-cwd>/<session-id>.jsonl.
What to watch
Any follow-up from Anthropic or repository maintainers confirming or ruling out server-side involvement; whether the reporter or others can reproduce the pattern on demand under the cache-miss condition described in the thread; and whether the minecraft.py explanation is confirmed or ruled out by someone with direct access to the raw session logs.
For practitioners
Treat this as an open, actively debated report rather than a confirmed vendor incident. If you run Claude Code on sensitive codebases, retain and inspect your own local session files when something looks anomalous before escalating it as a cross-tenant exposure, and separately track whether Anthropic issues any advisory referencing session or cache handling in Claude Code.
Key Points
- 1A GitHub issue reports apparent session leakage in Claude Code, where an Enterprise ZDR session unexpectedly referenced Minecraft on macOS.
- 2The report drew real scrutiny (123 points, 45 comments on Hacker News), but commenters found a plausible benign cause alongside the leak theory.
- 3Practitioners running agentic CLIs on sensitive codebases should audit local session files first and watch for maintainer confirmation before assuming cross-account exposure.
Scoring Rationale
A reported session or cache leak in a widely used agentic CLI remains notable for engineers and security teams, and independent verification this round confirms the report is genuine and drew substantive community scrutiny (123 points, 45 comments on Hacker News) rather than passing unnoticed. However, the added evidence also surfaces a credible benign explanation (a coincidentally named Pygments lexer file) and there is still no vendor confirmation of a true cross-account or server-side leak, so the score is left essentially unchanged pending resolution.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
