**What happened** 1. The session was running in the Claude desktop app (Code tab), with the user following along from their phone via Remote Control. 2. Claude ran `ssh-copy-id` in the Terminal panel with `run_in_terminal`. It then told the user the command was "waiting for your VM password, so type it there." 3. From the phone, the user can't see or type into the Terminal panel. The only input they have is the chat box, so they typed the password there. 4. The password is now in the conversatio

Desktop app: Claude sends a password prompt to the Terminal panel while the user is on mobile via Remote Control, so the password gets typed into chat

Status Open

Maintainer reply None cached

Activity 0 comments · opened Sep 25, 2026

What happened

The session was running in the Claude desktop app (Code tab), with the user following along from their phone via Remote Control.
Claude ran ssh-copy-id in the Terminal panel with run_in_terminal. It then told the user the command was "waiting for your VM password, so type it there."
From the phone, the user can't see or type into the Terminal panel. The only input they have is the chat box, so they typed the password there.
The password is now in the conversation transcript, and was sent to the model.
Claude then refused to use the password, which is correct. But the leak had already happened, and the refusal gave the user no way forward.

Expected

Claude shouldn't start an interactive credential prompt in the Terminal panel when the user may be on a device that can't reach it. Or at least it should say explicitly: "Type it at your Mac's terminal prompt, never in this chat."
The mobile client should warn, mask, or block input that answers a pending password prompt.

Suggestions

Tell the model whether the user is currently on Remote Control or mobile.
Don't send interactive credential prompts to the Terminal panel during Remote Control sessions, or send them to a secure input on the phone.
Offer a way to redact a message that's already been sent.