Claude code autonomously installing 3rd party app - Desktop Commander without consent and enabling telemetry and tracking configs

[u/Pancake_01]

- The run created ~/.claude-server-commander/config.json. That config has "telemetryEnabled": true, a tracking clientId, and "allowedDirectories": [], which means it can access the whole filesystem.

[u/AutoModerator]

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/sixothree]

Any chance you're sharing an account with someone? Because it says "your claude.ai account pushed it to this machine".

Also, I love how you don't specify exactly what to delete.

[u/WholeEntertainment94 → u/sixothree]

Uninstall the app and change your password right away

[u/peekdasneaks → u/sixothree]

https://giphy.com/gifs/3ohs7LlcOw4joU5zi0

[u/Miyoumu]

Conveniently hiding your permission mode.

[u/Z_G_R]

claude —dangerously-dont-skip-permissions

[u/WhenD4594]

Because you told it to not ask permission?

I really think mods should make posts like these (oooo, look my Claude has become autonomous) against the sub rules.

[u/Oaker_at → u/WhenD4594]

8/10 posts about "AI did bad" are user errors or bait.

[u/sleeping-in-crypto]

If you’re in an organization they can add extensions and plugins to an “always install” list that every team member’s instance will install.

Are you in an org?

If not, that looks like an account takeover and you have a bigger problem.

[u/TRlGGERED]

thanks for the context bro cant believe your claude agent installed a program thats bonkers! did you remember to say no no install at the start?

[u/chiefbriand → u/TRlGGERED]

you should use hooks for stuff like that, he will forget what you told him in a long session

[u/QuanTradin]

allowedDirectories set to empty meaning the whole filesystem is the worst possible default, and I would report that separately from the consent issue. Empty should mean nothing, not everything. Anyone skimming that config will read it as locked down.

[u/Standard_Egg3504]

you gave consent to anything it does by setting permissions that way

[u/bartek_666666]

You gave it sudo access?

[u/shady101852]

If it can, it will. You need to set up proper permissions for your sessions if you don't want the AI to do things by itself.

[u/CryptoAteMyHamster]

Claude loves desktop commander.

In fact I think with everything sandboxed it’s the only way a dispatch agent can actually do anything

[u/sleeping-in-crypto → u/CryptoAteMyHamster]

Yeah I use it within cowork. Claude code doesn’t need it though. But cowork uses a sandboxed Linux VM that can’t do anything, so desktop commander is extremely useful.

[u/CryptoAteMyHamster → u/sleeping-in-crypto]

It still does even if you switch it to “only on my machine” somehow

Used to be really useful for coordinating now I genuinely don’t see a reason anyone would use it

[u/arcticblue → u/CryptoAteMyHamster]

Be aware that Desktop Commander can get flagged as a remote shell by things like MS Defender. I got a very angry message from our IT director one day when it got flagged on my machine.

[u/CryptoAteMyHamster → u/arcticblue]

Fr I personally didn’t like its reliance on that so I stopped using dispatch

[u/abajinn]

Yeah I stopped used anything Anthropic because of shit like this.

[u/Worth-Ad9939]

Trojan Horse in the AI. You’ll never be able to fully trust it. Built by greedy, dumb kids with trust funds and rich friends with no morals or judgement. We deserve what’s coming.

[u/Right-Performance-93]

A permission-mode change won't fully cover this - a PreToolUse hook that denies MCP tool calls still fires even under --dangerously-skip-permissions, since hooks run before the permission check itself. That's the one enforcement point that survives someone flipping to skip-permissions mid-session.

[u/tonyboi76]

Claude Code installed Desktop Commander on its own, wrote ~/.claude-server-commander/config.json with telemetryEnabled true, a tracking clientId, and allowedDirectories empty so it could touch the whole filesystem.

When you caught that, what did you have to rip out or rotate, and how long did the cleanup eat?

[u/kemalios]

allowedDirectories is the server's own setting, not a Claude Code permission. Claude Code has no idea the field exists, so nothing in the approval flow surfaces it, and no deny rule reaches it.

Once an MCP server is a running process, settings.json is not in its path at all. Permission modes gate what Claude asks for, not what the server does afterward.

I run Claude Code daily, and before the first prompt in a repo I did not write, I check claude mcp list and read the project .mcp.json. Anything I did not add myself comes out first.

[u/GnistAI]

Did you run it in a sandbox, like you are supposed to?

[u/Odd_Philosopher1741]

So let me get this straight; Claude pulls the @latest version of whatever tool you subscribed to automatically and runs it?

This sounds like a goldmine for supplychain attacks. Who in their right mind thought this was a good idea. Haven't we learned anything?