Watched Claude Code desktop leak today. New session opens, SessionStart hook injects a "Last Request" line from a totally unrelated session, wrapped in <system-reminder> so it reads as authoritative. The cross-session FTS5 index is global, not thread-scoped.
@AnthropicAI feels buggy.