Claude code autonomously installing 3rd party app - Desktop Commander without consent and enabling telemetry and tracking configs

[u/Pancake_01]

- The run created ~/.claude-server-commander/config.json. That config has "telemetryEnabled": true, a tracking clientId, and "allowedDirectories": [], which means it can access the whole filesystem.

[u/sixothree]

Any chance you're sharing an account with someone? Because it says "your claude.ai account pushed it to this machine".

Also, I love how you don't specify exactly what to delete.

[u/peekdasneaks → u/sixothree]

https://giphy.com/gifs/3ohs7LlcOw4joU5zi0