{"version":"2.1.299","anchor":"inbox-owner-sender-claim-is-downgraded-to-third-party-unless","canonical_anchor":"inbox-owner-sender-claim-is-downgraded-to-third-party-unless","heading":"Inbox messages claiming to be from you are no longer trusted unless confirmed","tier":"notice","area":"Remote Control","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.299\/e\/inbox-owner-sender-claim-is-downgraded-to-third-party-unless","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.299","markdown":"### Inbox messages claiming to be from you are no longer trusted unless confirmed\n\nA Remote Control inbox message that says it is from the owner is treated as from an unknown sender unless the server confirmed it\n\n**What**\n\nRemote Control lets you steer a Claude Code session from elsewhere, and messages can arrive through an inbox. When a message fetched from that inbox says it comes from the owner, Claude Code now checks whether the server told this session that the message really is the owner's. If it did not:\n\n- the message is treated as coming from an unknown sender\n\n- its attachments and sender display are removed\n\n- a warning is logged\n\nThis behaviour is controlled remotely, and the code falls back to on when the server sends nothing.\n\n**Why**\n\nThis is a security safeguard. It stops someone from labelling a message as yours so that Claude Code follows it as your instruction.\n\n- Flag `tengu_humming_star`: Not enough to say (read for one account on one subscription tier against v2.1.299; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: Remote Control\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: yes"}