Security Alert: Suspected Cross-Account Session Leakage in Claude Code

This report summarizes a critical bug filed in the anthropics/claude-code repository regarding a potential breach of session isolation.

🚨 Issue Overview: #74066

Title: Potential session/cache leakage between workspace instances or consumer accounts
Reporter: @milesrichardson-edb
Date Filed: July 4, 2026
Status: Resolved $\rightarrow$ Open

The Incident

The user reported a jarring anomaly where the AI agent began hallucinating or recalling data from a completely unrelated context. Specifically, while the user was authenticated within an Enterprise ZDR (Zero Data Retention) workspace, the agent suddenly:

1. Inquired about the specific types of bricks required for a Minecraft temple.
2. Confidently stated in its session recap that it was currently in the process of constructing said temple.

"Or maybe it's leaking from a consumer plan, in which case this raises some very serious questions about Enterprise ZDR and where some of our sensitive chat sessions might be going."

---

🛠️ Technical Environment

The following specifications were provided to help developers reproduce the issue:

---

🔍 Analysis of Contextual "Pollution"

The reporter admitted to a non-standard workflow that might have caused some local confusion, though they maintain this is distinct from the Minecraft leak.

The Workflow:

• Step 1: Launched the session in a directory containing a .claude folder (for specific context).
• Step 2: Instructed the agent to perform work in a different directory.
• Step 3: The agent eventually ignored the instruction, compacted the conversation, and began modifying the launch directory.

The user defines this as "earlier pollution," but notes that $\text{Local Directory Error} \neq \text{Cross-Account Data Leak}$.

Logical Representation of the Concern

If we define $S_{ent}$ as the Enterprise session and $S_{cons}$ as a random consumer session, the user is concerned that: $P(S_{cons} \cap S_{ent}) > 0$ Where the intersection represents leaked cache or session data.

---

📉 Suspected Leakage Flow

The following diagram illustrates the feared path of the data leakage:

---

📋 Bug Tracking Checklist

• Report issue to GitHub
• Reproduce in isolated macOS environment
• Audit Enterprise ZDR isolation boundaries
• Verify cache clearing mechanisms between account switches

🖼️ Evidence & Attachments

User Profile:

Incident Screenshot:

Tooling Reference:

# Potential command to check local cache (hypothetical)
ls -la ~/.claude/cache/