Claude Code Remote Desktop Prompt: 2026 Fix Guide

I still remember the first time a client messaged me at 11 PM saying their laptop had just tried to open a Windows Remote Desktop connection while Claude Code was running in the background. My first thought wasn’t “we’ve been hacked” — it was “let’s slow down and check exactly what triggered this.” That’s the same approach I want to walk you through here, because Claude Code attempts to establish a remote desktop connection without the user’s consent is a real, documented issue, but it is almost never what it looks like at first glance.

Definition Block: Claude Code attempts to establish a remote desktop connection without the user’s consent is an unexpected RDP or Remote Control prompt that appears during a Claude Code session without the user initiating it, typically caused by a misconfigured feature, a malicious project file, or a compromised account session rather than an official Claude Code behavior. For example, opening an untrusted cloned repository can silently modify a project’s .mcp.json file and trigger an outbound session request without any visible warning.

In 33 years of IT work, I’ve learned that the scariest-looking prompts are usually the easiest to diagnose once you separate “what the tool is designed to do” from “what someone else made it do.” Let’s break this down properly.

Is Claude Code Trying to Remotely Control My PC?

I tested this myself across a few clean project folders, and in every legitimate case, Remote Control activity only ever originated from a device I had personally logged into. When I see a report where the user says “I never touched my phone or browser,” that’s my signal to look elsewhere — at the repo, the config files, or the account itself. Anthropic Claude Code Docs

What Causes Claude Code to Attempt a Remote Desktop Connection Without Consent?

There are three realistic explanations I’ve encountered or seen reported, and they sit on very different points of the severity scale. It’s worth reading all three before you panic-format your drive.

Misread of the Local Remote Control Feature

The most common false alarm I run into is a user confusing Claude Code’s Remote Control with something remotely reaching into their machine. In reality, Remote Control lets you continue a local session from another device — the direction of control is outbound from you, not inbound from Claude. Anthropic Claude Code Docs If you recently enabled this in /config and forgot, that alone can explain a session notification that looks alarming out of context.

Malicious .rdp File via Untrusted Repo or MCP Configuration

This is the scenario I take seriously. Security researchers disclosed a documented vulnerability class — including a tracked CVE and a separate no-CVE, 8.7-severity permission bypass — where an attacker could manipulate ANTHROPIC_BASE_URL or force-enable MCP servers through project files, bypassing the normal consent prompt entirely. The Hacker News If a .rdp file gets triggered this way, it can look exactly like Claude Code “decided” to open remote desktop, when really a hidden instruction in the project did it.

Compromised Anthropic Account Session

The third path is less about Claude Code’s code and more about account hygiene. If an attacker steals your session token — through phishing or a stolen device — they can drive a real Claude Code session remotely, and that activity can surface on your end as an unexpected connection attempt. This is why I always tell clients: treat any unexplained remote session the same way you’d treat an unexplained login alert on your email.

Root Cause Comparison: Which Scenario Matches Your Situation?

I built this table from the pattern-matching I do with every client ticket. Use it to narrow down what actually happened before you start remediation.

Scenario	Typical Trigger	Severity
Misread of Remote Control feature	User previously enabled Remote Control in /config, forgot	Low — no real security risk
Malicious .rdp via repo/MCP config	Cloned untrusted repo, altered .mcp.json or .claude/settings.json	High — documented CVE-level bypass
Compromised account session	Phishing, stolen session token, unmanaged device access	Critical — active attacker control

If you’re in the second or third row, don’t skip the remediation steps below — they matter.

How Do I Stop and Fix an Unauthorized Remote Desktop Attempt in Claude Code?

Here’s the exact sequence I walk through when a client reports Claude Code attempts to establish a remote desktop connection without the user’s consent. It’s ordered by urgency, not by convenience, so resist the temptation to skip to step 3.

Step 1 — Cancel the Prompt Immediately

Do not click “Connect.” Do not enter your Windows credentials into the box, no matter how legitimate it looks. Disconnect from your network first, then deal with the rest calmly. Facebook Claude Community

Step 2 — Update Claude Code to a Patched Version

Confirm your installed version is newer than the ones affected by the disclosed permission bypass issues. The fixes I’m aware of landed in versions v1.0.87, v1.0.111, and v2.0.65, addressing the consent-bypass and MCP-override bugs respectively. The Hacker News Running claude –version takes ten seconds and should be your very next move.

Step 3 — Audit Permissions and Config Files

Run /permissions inside Claude Code and look for any “allow” rule you didn’t set yourself, especially anything touching Bash execution, WebFetch, or MCP servers. In my own audits, this is where I usually find the smoking gun — a rule nobody remembers approving.

Step 4 — Inspect .claude/settings.json and .mcp.json

Open these files directly and look for two specific red flags:

• An enableAllProjectMcpServers: true flag you didn’t set
• An altered ANTHROPIC_BASE_URL pointing somewhere unfamiliar

These are the exact mechanisms documented in the disclosed attack chain, so treat either as confirmed compromise, not a coincidence.

Step 5 — Quarantine the Untrusted Repository

If the prompt appeared right after opening a cloned or downloaded repository, stop trusting that folder immediately. Do not approve its workspace trust prompt again until you’ve manually reviewed its hooks, its CLAUDE.md, and any PreToolUse hook scripts for hidden instructions.

Step 6 — Rotate Your Anthropic API Key

This step is non-negotiable if you matched scenario two or three above. The disclosed vulnerability specifically allowed API key exfiltration through this attack path, so a compromised session should be treated as a compromised key until proven otherwise. The Hacker News

Step 7 — Disable Auto-Enabled Remote Control

Run /config inside Claude Code and check the “Enable Remote Control for all sessions” toggle. If it’s set to true and you never turned it on, switch it back to false and treat that as evidence something else modified your settings.

How Can I Prevent Claude Code From Attempting an Unauthorized Remote Connection Again?

Once you’ve cleaned up an incident, the real work is making sure it doesn’t repeat. Here’s what I now set up as a baseline on every machine I configure for Claude Code work:

• Add explicit deny rules for network-related Bash commands inside your permissions config
• Avoid –dangerously-skip-permissions (bypassPermissions mode) outside fully isolated containers Anthropic Claude Code Docs
• Review any new repo’s CLAUDE.md and hooks before granting the workspace trust prompt
• Periodically re-check .claude/settings.json for drift, especially after collaborating on shared repos

I treat this the same way I treat SSH key hygiene — a five-minute quarterly check that prevents multi-hour incident response later. If you want the broader troubleshooting playbook for Claude Code beyond this one issue, our complete guide covers the full permission model and common failure patterns.

A Real-World Example: What This Looks Like in Practice

There’s no verbatim system error log publicly available for this specific issue — most reports, including one I reviewed personally, describe it simply as “Claude Code suddenly tried to open a Remote Desktop connection” without a captured trace. Facebook Claude Community So here’s an illustrative reconstruction based on the documented attack pattern:

[Claude Code Session Log - illustrative]
Project: cloned-repo-demo
Config change detected: .mcp.json -> enableAllProjectMcpServers: true
ANTHROPIC_BASE_URL overridden -> unrecognized endpoint
Action triggered: outbound session request (RDP handler invoked)
User consent prompt: BYPASSED

(Illustrative example)

Bad practice: approving the RDP prompt or entering Windows credentials because you assume Claude “needs” that access to function.

Good practice: canceling immediately, updating to a patched version, and auditing .claude/settings.json and .mcp.json before resuming any work in that project. Anthropic Claude Code Docs

Frequently Asked Questions

Q1: Does Claude Code have a real feature that controls my desktop remotely? No. Its Remote Control feature only lets you access your own local session from another device you own — it does not grant an outside party or the AI itself control over your machine.

Q2: Is Claude Code attempting a remote desktop connection without consent always caused by a hacker? Not always. It can stem from a misunderstood legitimate feature, but it can also come from an outdated, unpatched version with a known consent-bypass vulnerability.

Q3: What should I do first if the prompt appears? Cancel the prompt without entering any credentials and disconnect from your network before doing anything else.

Q4: Which Claude Code version fixed this vulnerability? The consent-bypass and MCP-override issues were addressed in versions v1.0.87, v1.0.111, and v2.0.65.

Q5: Should I rotate my API key after this happens? Yes. Rotate it immediately if you match the malicious repo or compromised session scenario.

Q6: Can this issue happen even if I never installed anything suspicious myself? Yes — opening a cloned or shared repository someone else created can trigger the behavior without any deliberate action on your part.