Claude Code Bug Report Flags Possible Session Data Leakage Between Accounts

·1 views

A security concern has been raised on the official Claude Code GitHub repository regarding potential session or cache data leakage between separate workspace instances or consumer accounts. The issue, filed under Anthropic's claude-code project, suggests that data intended for one user or workspace may be incorrectly accessible by another. The report has garnered attention on Hacker News, accumulating 14 points and several comments. Such a vulnerability, if confirmed, could have serious privacy implications for users of the platform. Anthropic has not yet publicly confirmed or resolved the issue at the time of reporting.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Proxmox VE 9.2-1 Install and Update Guide: Key Steps and Post-Setup Fixes

Proxmox VE 9.2-1, built on Debian 13 'Trixie' and released on May 21, 2026, is the current version of the open-source virtualization platform. The installation process uses a graphical installer written to a USB drive, with tools like dd on Linux, Etcher or Rufus in DD mode on Windows, and hdiutil on macOS recommended for creating bootable media. A common post-install issue involves the default repository requiring a paid subscription, which must be switched to the free community repository for updates to work. During setup, users must choose a target disk and filesystem, with ext4 recommended for single-drive builds and ZFS suited for multi-drive configurations with mirroring or RAID. The guide also warns against using UNetbootin for media creation and stresses verifying the ISO checksum before writing to avoid corrupt or tampered installations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Security researcher builds static scanner to catch hidden MCP tool poisoning attacks

A security researcher has developed an open-source tool called mcpscan after discovering that malicious instructions can be hidden inside MCP server manifests using invisible Unicode characters, such as zero-width spaces and bidirectional overrides, making them undetectable during code review. The attack class, known as tool poisoning, embeds harmful directives in tool metadata rather than executable code, causing AI agents to silently follow instructions like exfiltrating SSH keys or environment files. The threat is timely given the MCP ecosystem surpassed 14,000 public servers in 2026, with one 60-day period alone producing over 30 CVEs, nearly 43 percent of which involved command injection, and 492 servers found exposed without any authentication. mcpscan is a static, offline Python tool requiring no runtime dependencies that scans MCP manifests, Claude Code project directories, and source files for twelve categories of risk before installation. The tool and its deliberately vulnerable test fixtures are publicly available on GitHub for developers to audit MCP servers prior to deployment.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Hiding UI Elements Is Not Enough: Frontend Apps Must Also Gate API Requests

A common frontend security oversight involves hiding unauthorized UI elements while still allowing the underlying API requests to fire, exposing backend endpoints to potential attackers. Proper frontend authorization requires three distinct layers: controlling what users see, preventing unauthorized data fetches, and enforcing permissions on the server side. In React Query, for example, omitting the 'enabled' flag on a useQuery hook means the request executes before any permission check runs, returning a 403 error and revealing that the endpoint exists. Developers are advised to gate requests at the data layer by conditionally enabling queries only after confirmed permissions, and to avoid optimistic access assumptions that can briefly expose restricted UI elements. Addressing all three authorization gates improves security posture, reduces server load, and ensures the frontend accurately reflects backend access rules.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds 6-Agent AI System to Analyze Privacy Policies for Hidden Risks

A developer created TrustGuard AI, a multi-agent system designed to automatically analyze privacy policies that most users never read. Built for the Microsoft Agents League Hackathon using Azure AI Foundry and GPT-5.4, the tool runs a sequential six-agent pipeline covering extraction, legal reasoning, dark pattern detection, readability scoring, rights auditing, and policy benchmarking. Each agent passes context to the next to build a comprehensive risk profile of any given privacy policy. The system also checks compliance against six global data protection frameworks, including GDPR and CCPA, and can detect when companies quietly update their policies using SHA-256 change tracking. The open-source project is built with Python, Flask, and vanilla JavaScript, and is available to run locally via GitHub.

0 comments Read more at DEV Community