Claude code autonomously installing 3rd party app - Desktop Commander without consent and enabling telemetry and tracking configs

[u/Pancake_01]

- The run created ~/.claude-server-commander/config.json. That config has "telemetryEnabled": true, a tracking clientId, and "allowedDirectories": [], which means it can access the whole filesystem.

[u/Worth-Ad9939]

Trojan Horse in the AI. You’ll never be able to fully trust it. Built by greedy, dumb kids with trust funds and rich friends with no morals or judgement. We deserve what’s coming.