A CLI agent that spontaneously brings up a Minecraft temple in a project with no connection to video games: the anecdote might raise a smile if it didn’t point to a fundamental security question. This unexpected behavior led a developer to open Issue #74066 on Anthropic’s official repository on July 4, 2026, flagging a session or cache leak between distinct workspaces in Claude Code.
The Claude Code Session Leak in Detail
The user milesrichardson-edb describes a specific case: their Claude Code agent, authenticated through an Enterprise ZDR (Zero Data Retention) workspace, suddenly started asking what kind of bricks they wanted for their Minecraft temple. The agent even claimed in its summary that it was in the middle of building a Minecraft temple.
The problem is clear: that context didn’t come from the current session. The user puts forward two hypotheses.
- A colleague was actually working on a Minecraft project, and the cache isn’t properly isolated between workspaces within the same organization.
- The context came from an external consumer account, which would raise far more serious questions about data isolation in an Enterprise ZDR environment.
Why Enterprise ZDR Makes This Bug Critical
Enterprise ZDR is a strong contractual guarantee. It states that no session data is retained or shared between users or organizations. That’s precisely what security teams look at before deploying an agentic tool on sensitive projects.
If a context leak is confirmed despite this guarantee, it calls tenant isolation into question at a fundamental level. In professional use, Claude Code sessions can contain proprietary code, credentials, internal architectures, or confidential business data.
Cross-contamination of context, even partial, represents a risk of unintentional disclosure of sensitive information.
What We Know and What We Still Don’t
The report is detailed and honest about its own limitations. The user acknowledges an unusual setup: they launched the agent from a working directory different from the target directory, with a .claude folder containing context. They also mention that the agent compacted its conversation at some point, which caused a directory confusion.
These elements are separate from the Minecraft issue. The user draws a clear line between them in the report. But they introduce enough noise that the root cause remains undetermined.
Here’s what we don’t know yet:
- Whether Anthropic has reproduced or confirmed the bug internally.
- Whether the leak comes from an application cache, a memory isolation bug, or an infrastructure-level routing issue.
- Whether other users have observed similar behavior.
- Whether the problem affects only Enterprise accounts or consumer accounts as well.
No official response from Anthropic has been documented at this stage.
A Weak Signal, but Technically Serious
A single report doesn’t make a systemic vulnerability. That’s a basic principle in security: you need to reproduce a behavior before drawing conclusions. But a weak signal in a CLI tool aimed at professional use, one that claims ZDR guarantees, deserves immediate attention rather than being put on the back burner.
Claude Code was built for complex agentic workflows, with filesystem access, command execution, and code manipulation. In that context, the blast radius of a context leak is much larger than in a simple web chatbot.
The limited media coverage and absence of a mass reaction suggest the issue hasn’t reached critical mass yet. That could change quickly if more similar cases surface.
Key Takeaways
- A bug reported on GitHub (Issue #74066) describes an apparent context leak between Claude Code workspaces, despite active Enterprise ZDR authentication.
- The ZDR guarantee is precisely what security teams rely on to validate Claude Code for use in sensitive professional environments.
- The technical root cause remains unknown: application cache, faulty memory isolation, or an infrastructure bug are all open hypotheses.
- Anthropic has not published an official response at this stage: the GitHub ticket is the only available tracking source.
- Watch closely: updates to Issue #74066 and any official communication from Anthropic on tenant isolation in Claude Code.
If you’re using Claude Code in an Enterprise context, this ticket deserves a spot on your watchlist. If you want to discuss best practices for isolation in agentic CLI tools, find me on the blog or on LinkedIn.
Sources
- Issue #74066, anthropics/claude-code, GitHub: primary bug report, technical description of the observed behavior, opened July 4, 2026.