HN Explorer

Tell HN: Check Claude CLI, it may have silently enabled remote access

1 points by cromka ↗ HN
I went to https://claude.ai/code today and saw some of my most recent Claude CLI sessions appeared there. I have never explicitly enabled RC, specifically because of security concerns and the only sessions I previously had in https://claude.ai/code were the ones I actually started there out of convenience, whenever I was away from my dev machine.

So imagine my complete shock when I saw those sessions in their web client and that /rc was actually enabled in my CLI! Again, I never enabled it!!!

Notably, there was a recent bug fixed 3 days ago (https://github.com/anthropics/claude-code/releases/tag/v2.1.257) which reads:

"Fixed dismissing the Remote Control consent prompt (Esc, or n at claude remote-control) counting as consent, so the next request connected without asking"

But MY GOD, if this is what happened here to me—even though I don't recall being asked that question—then Anthropic NOT handling this properly by disabling RC or re-asking users to double-check their config and expliotly re-enable it is just unimaginable.

This has personally absolutely drew the line for me with them. I use Codex simultaneously and as soon as they release GPT6, I am canceling my sub. Enough is enough.

5 comments

[ 0.22 ms ] story [ 2.2 ms ] thread
gar1t
It'd be interesting to see if there's a record of this in your sessions. You can ask Claude to check there.
cromka
> It'd be interesting to see if there's a record of this in your sessions

You mean whether there was indeed a question where they asked me for RC and I refused? Good call, I'll see if I can find it.

ebcode
From https://code.claude.com/docs/en/remote-control :

    Feature-flag evaluation: DISABLE_TELEMETRY, DO_NOT_TRACK, CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC, and DISABLE_GROWTHBOOK each
    disable the feature-flag evaluation that Remote Control availability depends on. Unset the variable
    wherever it’s set, in your shell environment or in the env block of a settings.json file, to use Remote Control.
I just discovered the same thing, that my local sessions were sent to claude.ai/code and stored there. I added:

    "env": {
        "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1"
    },
to my .claude/settings.json file, and the /rc in the corner went away.
brazukadev
Anthropic has gonna completely wild lately, they don't care a bit about their customers.
relug
anything to train on juicy dev chats hehe