Does Claude Code also “spoof serial numbers”? Accused of using a stranger’s password to cross-server database tampering

According to Beating monitoring, a user submitted a report on GitHub claiming that when using Anthropic’s command-line AI assistant Claude Code, the AI’s conversation context suddenly contained server IPs, usernames, and plaintext root passwords that did not belong to it. The local AI assistant then directly read these passwords, automatically connected to someone else’s server via SSH, and made write modifications to the database. In other words, the user’s own AI used someone else’s account credentials, mistakenly connected, and modified another person’s production database.

After analyzing the issue, community technical staff believe the root cause may be a failure in the isolation mechanism of the large model’s “prompt prefix cache.” To reduce computational costs and speed things up, cloud-based large models cache the earlier parts of users’ conversations. If cache keys collide between different users or the isolation mechanism becomes confused, another user’s confidential cached data could be mistakenly spliced into your conversation. If this hypothesis is true, any developer using Claude Code faces the risk that their server account credentials and core source code could be inadvertently mixed into—and exposed to—other users.

However, it is also not ruled out that this is merely the model’s hallucination, which happened to guess the real IP and a weak password, or that the local project’s historical records have contaminated the context. At present, this topic has already been tagged with a security classification (area:security) by GitHub’s automated system, and all parties are awaiting the official verified conclusion.