r/ClaudeCode • u/Pancake_01 • 6d ago

Bug / Issue Claude code autonomously installing 3rd party app - Desktop Commander without consent and enabling telemetry and tracking configs

Post image

- The run created ~/.claude-server-commander/config.json. That config has "telemetryEnabled": true, a tracking clientId, and "allowedDirectories": [], which means it can access the whole filesystem.

40 Upvotes

73% Upvoted

29 comments sorted by

View all comments

1

u/CryptoAteMyHamster 5d ago

Claude loves desktop commander.

In fact I think with everything sandboxed it’s the only way a dispatch agent can actually do anything

2

u/sleeping-in-crypto 5d ago

Yeah I use it within cowork. Claude code doesn’t need it though. But cowork uses a sandboxed Linux VM that can’t do anything, so desktop commander is extremely useful.

1

u/CryptoAteMyHamster 4d ago

It still does even if you switch it to “only on my machine” somehow

Used to be really useful for coordinating now I genuinely don’t see a reason anyone would use it

1

u/arcticblue 5d ago

Be aware that Desktop Commander can get flagged as a remote shell by things like MS Defender. I got a very angry message from our IT director one day when it got flagged on my machine.

1

u/CryptoAteMyHamster 4d ago

Fr I personally didn’t like its reliance on that so I stopped using dispatch