The single most useful thing right now is to localize where that "Minecraft temple" text actually lives — that determines whether this is a local context bleed on your machine or a genuine cross-account/server leak, and those are wildly different severities. Don't assume either until you've run the check below.

Triage: is the leaked content anywhere in your local session files?

Everything your CLI sends and receives is written to per-session transcripts at ~/.claude/projects/<encoded-cwd>/<session-id>.jsonl (the <encoded-cwd> is your launch directory with every / turned into -). So:

grep -rli 'minecraft\|temple\|brick' ~/.claude/projects/ 2>/dev/null

• If it hits a file → that text is present locally, so this is a local context/transcript bleed, not a server-side leak. Given your setup (launched in dir A that has its own .claude, worked in dir B, then a /compact), the likely path is that the session pulled in context belonging to a different session/slug on your own machine — annoying and worth fixing, but not a ZDR breach. Confirm which session it came from:

  grep -rli minecraft ~/.claude/projects/ | while read f; do
    printf '%s  %s\n' "$(grep -m1 -o '"cwd":"[^"]*"' "$f")" "$f"; done

  A different cwd/slug than the one you're working in confirms a local cross-session bleed.

• If it hits nothing locally → you never sent or received that text on this machine, which points to the model/server side. For an Enterprise ZDR workspace that is exactly the serious case you're worried about — treat it as a security incident: preserve the Feedback ID (f336f5d2-…) and the screenshot, and escalate through your Anthropic enterprise contact, not only a public issue.

On the launch-dir / work-dir setup

The part you already diagnosed (compaction made it start working in the launch dir) is a related but separate issue. Claude keys a lot of context off the launch cwd — that's also where the transcript is stored, ~/.claude/projects/<launch-dir-slug>/ — so launching in an unrelated dir that has its own .claude invites context confusion after a /compact. Launching from the actual work dir (or pointing --add-dir at the context dir instead of cd-ing into it) avoids that whole class of confusion. But that mechanism explains the directory mix-up, not a Minecraft prompt you never wrote — so run the grep before concluding it's just your setup.

To be clear about what I did and didn't check: I verified only that these transcripts are local, greppable, and carry the cwd of the session that produced them (that's what makes the localize test reliable). I can't see your server-side session state, so the local-vs-server split above is the honest way to tell which problem you actually have — and it's worth doing before this gets triaged as either "user setup" or "ZDR breach", because it's cheap and decisive.

There are no matches other than the log of this session itself, starting with the first apparent leak and then followed by my exchange with the model about why it did that . There is one tool call result that includes a string that printed a pathname including minecraft.py because it was listing the files in a Python virtual environment and the Pygments package has a lexer called minecraft.py

There is no match for temple or bricks, at least with those word boundaries or within any context remotely related to Minecraft (there are matches like Databricks and bricked by an over-eager click and verdictSignalsLabel (has slab substring)).

I've submitted via /feedback and escalated internally.

Vibe coding company has vibe coding security, what a surprise.

It looks like an hallucination. Last time Claude said a thousand adjectives or bad words that had nothing to do with what I was working on.

This issue has reached the top of Hacker News today. Would love if you could add some additional information to your report here.

Are you able to find and upload the actual chunk of context that it thought was injected? Or at least ask it to repeat it verbatim?

To Anthropic’s credit, the info in this report isn’t really a lot for them to go off of, nor is it clearly a bug.

There is one tool call result that includes a string that printed a pathname including minecraft.py because it was listing the files in a Python virtual environment and the Pygments package has a lexer called minecraft.py

99% chance this triggered a hallucination

i may add here, i also noticed that other people appeared to have received one subsection of features from a completely lined out specification file i prepared during a hackathon, whereas my agent built something completely different in this subsection (separate consumer accounts). a slight variation on their project-name also was put down in our repo out of nowhere.
not sure whether they use this, but there has been a known issue of context leakage between shared KV-caches in inference.

I reported this weird bug last week:

Claude Code, Sonnet 5:

Before the inventory: a brief integrity note, then the full findings.
Data-integrity note: Partway through this task, one batch of tool results contained injected content that did not come from the tools I actually called — a fabricated "MCP servers need auth" notice, an unsolicited dump of a different CLAUDE.md, and fake "Plan mode is active" instructions telling me to stop and use tools I don't have. I disregarded that injected content and re-verified the real filesystem state directly; everything below is from genuine tool output.

claude once told me that a store is nearby (location) from where i live but the location was from where my friend lives whom ive never ever mentioned in a chat but he also uses claude in the same office.

I wrote up a related Claude incident here: https://noperator.dev/posts/pelicant

I initially thought I was seeing another user’s data, but Anthropic later said it was internal agent context being surfaced incorrectly. Not sure if the same thing is happening here.

This rings a bell. I had this happen to me in 2025 several times when I was using api tokens. It seemed like it invented tools of other agents, which my agent didn't even have.
In a different syntax. It was like I was all of a sudden in a different session. I thought it was probably a hallucination, and didn't dig deeper.

i dont think this is a claude-code issue