### Preflight Checklist - [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet - [x] This is a single bug report (please file separate reports for different bugs) - [x] I am using the latest version of Claude Code ### What's Wrong? ### Summary Text being typed into the Claude Code chat input (VS Code extension) appears to be leaking into unrelated files downloaded via Chrome shortly

[BUG] Leakage from claude code conversations to browser downloads

Status Open

Reported on v2.1.220

Maintainer reply None cached

Activity 0 comments · opened Aug 2, 2026

Preflight Checklist

[x] I have searched existing issues and this hasn't been reported yet
[x] This is a single bug report (please file separate reports for different bugs)
[x] I am using the latest version of Claude Code

What's Wrong?

Summary

Text being typed into the Claude Code chat input (VS Code extension) appears to be leaking into unrelated files downloaded via Chrome shortly afterward. Confirmed 3 times: a file downloaded from a web app running in Chrome (Home Assistant, via its browser-based UI) arrives in ~/Downloads with a few stray characters prepended to its content, and those characters match a fragment of text that was being typed into the Claude Code chat panel at approximately the same time — not anything related to the downloaded file's actual source or content.

Environment

Claude Code (VS Code extension): 2.1.220
Model: Sonnet 5 (claude-sonnet-5)
OS: macOS (Darwin)
Browser: Chrome
Reproduced both before and after a full machine reboot + VS Code restart — not tied to a single stuck process/session.
Evidence
Three separate downloads of the same type of file (a diagnostic YAML dump from a Home Assistant add-on's web UI), each corrupted with a different stray prefix, each matching nearby Claude Code chat text:

File 1: began with a single stray o before the real first line (CONFIG_ITEMS:).
File 2: began with "U can " before CONFIG_ITEMS: — a near-exact fragment of the chat message being sent at the time: "You can see my predbat and ha setups..." (missing the leading "Yo").
File 3: began with "ted" before CONFIG_ITEMS: — the exact tail end of the word "corrupted", from a chat message sent moments before the download, that appears to have been cut off/submitted mid-word.
In all three cases the actual downloaded content picks up correctly right after the stray prefix, so this isn't file truncation — it's extraneous chat-adjacent text being prepended to an otherwise-intact file.

What we ruled out
Not the source app's bug: read the actual server-side download handler (plain YAML serialization → standard HTTP response) — clean, no shared buffers or unrelated string concatenation.
Not a stuck process/session artifact: reproduced again after a full reboot + VS Code restart.
curl against the same download URL directly was inconclusive (requires an authenticated session cookie a bare curl doesn't carry).
Why this matters
If partial chat input can end up in a file downloaded by an unrelated application, it's likely not limited to this one flow — a general leak of chat input into other processes' file writes is a real privacy/data-integrity concern beyond corrupting the occasional diagnostic file.

What Should Happen?

Downloads should not contain corruption from claude code conversations. Claude code should not leak conversaton

Error Messages/Logs

(base) ➜  pid_trainer git:(main) ✗ head ~/Downloads/predbat_debug.yaml-9.txt 
tedCONFIG_ITEMS:
- default: false
  entity: update.predbat_version
  entity_picture: https://user-images.githubusercontent.com/48591903/249456079-e98a0720-d2cf-4b71-94ab-97fe09b3cee1.png
  friendly_name: Predbat Core Update
  installed_version: v8.47.1
  name: version
  release_url: https://github.com/springfall2008/batpred/releases/tag/v8.47.1
  restore: false
  title: Predbat

Steps to Reproduce

(best understood so far)
Have Claude Code open in VS Code, actively typing/sending a chat message.
In Chrome, at roughly the same time, click a download link on an unrelated web page.
Check the first bytes of the downloaded file (head -c 40 <file> or xxd).
Compare against the chat message text being typed/sent around that same moment.
No fully deterministic repro yet (exact timing window, which keystrokes leak) — all three occurrences were noticed incidentally while debugging something unrelated.

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.220

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information