Claude Code Session and Cache Leakage Investigation

Anthropic Investigates Potential Session Leakage in Claude Code

Reports of potential session or cache leakage between workspace instances and consumer accounts in Claude Code have prompted an investigation by the Anthropic team. While some users have reported receiving responses that appear to belong to other users or contain unrelated context, Anthropic's initial assessment is that these occurrences are likely model hallucinations rather than a security breach.

Initial Findings and Official Response

Anthropic has officially stated that the reported behavior is likely a hallucination. Thariq from the Claude Code team noted:

We’re confident this is a hallucination but of course take these reports seriously and the team is looking into it.

One specific example cited in the discussion involves a tool call result containing a string with a pathname including minecraft.py. Analysts noted that this specific file is a lexer within the Pygments package, which is commonly found in Python virtual environments, making it a plausible explanation for the appearance of "Minecraft" references without requiring a data leak.

Community Perspectives on Model Hallucinations vs. Infrastructure Leaks

Technical discussions among users suggest two primary theories regarding the cause of these anomalies: model hallucinations and intermediate infrastructure failures.

The Hallucination Theory

Some users argue that high context windows (e.g., 800K+ tokens) increase the likelihood of hallucinations, where the model generates plausible but incorrect information that mimics the behavior of another user's session.

The Infrastructure Leak Theory

Other users point to the possibility of "swapped" responses occurring at the API gateway or intermediate infrastructure level. One contributor shared an experience with other major LLM providers where an API gateway incorrectly handled HTTP 100 status codes, resulting in an "off by one" error where users received the response intended for the previous caller.

Related Reports Across Other LLM Platforms

The discussion highlights that this phenomenon is not isolated to Claude Code. Users have reported similar experiences with other models:

• Gemini: Users reported receiving answers that appear to belong to other people, such as receiving a math tutoring response while researching a different topic.
• OpenRouter: Users noted receiving URLs that other people had previously provided to model providers.
• Claude Web: One user reported a session where the model insisted on message prefixes related to code execution that were not part of their current session.

Summary of Technical Risks

While Anthropic maintains that the issue is likely a hallucination, the community debate centers on whether the behavior is a result of the model's generative nature or a failure in the isolation of data within the intermediate infrastructure used to serve these models.