Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Tell HN: Check your Claude settings, it may have silently enabled remote access
7 points by cromka 3 days ago | hide | past | favorite | 6 comments
I went to https://claude.ai/code today and saw some of my most recent Claude CLI sessions appeared there. I have never explicitly enabled RC, specifically because of security concerns and the only sessions I previously had in https://claude.ai/code were the ones I actually started there out of convenience, whenever I was away from my dev machine.

So imagine my complete shock when I saw those sessions in their web client and that /rc was actually enabled in my CLI! Again, I never enabled it!!!

Notably, there was a recent bug fixed 3 days ago (https://github.com/anthropics/claude-code/releases/tag/v2.1.257) which reads:

"Fixed dismissing the Remote Control consent prompt (Esc, or n at claude remote-control) counting as consent, so the next request connected without asking"

But MY GOD, if this is what happened here to me—even though I don't recall being asked that question—then Anthropic NOT handling this properly by disabling RC and re-asking users to double-check their config and explicitly re-enable it is just unimaginable.

This has personally absolutely drew the line for me with them. I use Codex simultaneously and as soon as they release GPT6, I am canceling my sub. Enough is enough.

 help



From https://code.claude.com/docs/en/remote-control :

    Feature-flag evaluation: DISABLE_TELEMETRY, DO_NOT_TRACK, CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC, and DISABLE_GROWTHBOOK each
    disable the feature-flag evaluation that Remote Control availability depends on. Unset the variable
    wherever it’s set, in your shell environment or in the env block of a settings.json file, to use Remote Control.
I just discovered the same thing, that my local sessions were sent to claude.ai/code and stored there. I added:

    "env": {
        "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1"
    },
to my .claude/settings.json file, and the /rc in the corner went away.

reply


It'd be interesting to see if there's a record of this in your sessions. You can ask Claude to check there.

reply


I ask not to be snoopy I'm working on session scanners and this is the sort of bad behavior that should be detectable by looking at the record. It's a serious security breach - shipping sessions off somewhere without getting permissions.

reply


> It'd be interesting to see if there's a record of this in your sessions

You mean whether there was indeed a question where they asked me for RC and I refused? Good call, I'll see if I can find it.

reply


Anthropic has gonna completely wild lately, they don't care a bit about their customers.

reply


anything to train on juicy dev chats hehe

reply




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: