Session Isolation Bypass in Claude Code | Persistent Remote Tunnels Survive Account Switches via /login

I found this while poking at Claude Code’s authentication flow during an active Remote Control session. The short version: switching accounts mid-session using /login doesn’t disconnect an already-open Remote Control session. The session keeps running under the original account’s identity — the claude.ai web app or iOS app stays connected and fully interactive, completely unaware that the local CLI has moved on to a different account.

The /logout path handles this correctly — it tears everything down cleanly. But /login was written assuming it always runs from a cold start, so it skips any cleanup of the active Remote Control link. That gap is enough to maintain unauthorized cross-account access through an orphaned session (CWE-613).

Disclosure note: Reported to Anthropic’s security program. The fix shipped in v2.1.176. Documented here for the record.

---

How the Architecture Sets Up the Problem

Claude Code’s Remote Control feature links the local CLI session directly to a claude.ai web or iOS app session. When you enable Remote Control, the app connects to your CLI and can read and send messages on your behalf — same account, same session:

When you run claude auth logout, the CLI correctly tears down this link — the claude.ai or iOS Remote Control session disconnects immediately. That part works.

The problem is /login. Running it inside an active session rebinds the CLI to Account B. But the Remote Control link — already established and live on the claude.ai or iOS side — is never notified. From the app’s perspective, nothing changed. The session stays open, still scoped to Account A, and remains fully interactive.

---

Proof of Concept

Step 1a: Start a Remote Control session as Account A — Web

Launch Claude Code and enable Remote Control from inside a session:

$ claude

> /remote-control
# Terminal displays a session URL and QR code
# Open claude.ai/code in the browser and locate the session by name
# Session shows a green status dot — connected and live

The claude.ai web interface is now connected. Messages sent from the browser execute in the local CLI and responses stream back in real time.

Step 1b: Connect the iOS App to the Same Session

No setup needed on the app side. Because the iOS app is already signed in as Account A, it automatically picks up the active Remote Control session. Open the Claude app, go to the Code tab, and the session is already there — tap to enter.

Both the web interface and the iOS app are now connected to Account A’s session simultaneously. Either can send messages and see responses.

Step 2: Switch to Account B via /login without logging out

Without exiting or running claude auth logout, invoke the login command inside the same session:

> /login
# Browser opens — complete OAuth as Account B
# CLI is now locally bound to Account B

The local CLI has switched. Account B is now the active identity on the terminal side.

Step 3: Account A’s Remote Control session stays fully alive — on both web and app

Back on the claude.ai web interface and the iOS app — both connected in Steps 1a and 1b — nothing changed:

• The session is still open on both consumers. No disconnect, no warning, no re-authentication prompt on either the browser or the iOS app.
• New messages are visible. Any prompts sent after the /login switch appear in both consumers under Account A’s session history.
• Sending still works. Messages sent from the browser or iOS app continue to execute in the CLI and return responses — under Account A’s session, even though the CLI is now signed in as Account B.
• The boundary that should exist doesn’t. A user who ran /login believing they had cleanly switched identities has no indication that their previous Remote Control consumers are still reading and writing their session.

---

The Fix

Anthropic patched this in v2.1.176 (commit ca9f6045fc90c8244f9e787fb57d54b380f9a27c, released June 12 by ashwin-ant).

The changelog entry:

“Fixed Remote Control sessions not disconnecting when you sign in to a different account”

The behavioral change: /login now tears down any active Remote Control session before opening the browser OAuth flow. It matches what claude auth logout was already doing — the gap was simply that /login never had that step.

Status: Patched in v2.1.176. Reported to Anthropic’s security program.