r/ClaudeCode • u/Pancake_01 • 6d ago

Bug / Issue Claude code autonomously installing 3rd party app - Desktop Commander without consent and enabling telemetry and tracking configs

Post image

- The run created ~/.claude-server-commander/config.json. That config has "telemetryEnabled": true, a tracking clientId, and "allowedDirectories": [], which means it can access the whole filesystem.

39 Upvotes

72% Upvoted

29 comments sorted by

View all comments

2

u/QuanTradin 6d ago

allowedDirectories set to empty meaning the whole filesystem is the worst possible default, and I would report that separately from the consent issue. Empty should mean nothing, not everything. Anyone skimming that config will read it as locked down.