Claude Code user reports possible session bleed — agent starts building a Minecraft temple

A GitHub issue filed against Anthropic’s Claude Code (v2.1.199, macOS) describes what the reporter believes is session or cache leakage across isolated environments. While authenticated to an Enterprise Zero Data Retention (ZDR) workspace, the user’s agent abruptly began asking which bricks it should use for a Minecraft temple and insisted, in its own recap, that building the temple was its task — content wholly unrelated to the user’s actual work. The reporter’s worry is pointed: if that prompt bled in from another workspace instance or, worse, a consumer-tier account, it undercuts the isolation guarantees that ZDR customers pay for and raises the question of where their sensitive sessions might be flowing.

The report is anecdotal and unverified, and the reporter is candid about a nonstandard setup that muddies the picture. They launched the agent in one directory (to pick up a local .claude context folder) while directing the actual work elsewhere, and after a conversation compaction the agent lost track of instructions and started operating in the launch directory. They treat that context-bleed as self-inflicted and unsurprising — distinct from the Minecraft prompt, which they cannot explain by their own configuration.

The significance lies less in one strange transcript than in the trust model it probes. Cross-tenant or cross-account cache leakage would be a serious confidentiality failure for an enterprise product marketed on data isolation, so the claim warrants a concrete answer from Anthropic on how session state is scoped. Until reproduced or root-caused, though, it remains an unconfirmed report — and a memory or context-management glitch within the user’s own session is at least as plausible as genuine tenant crossover.