Intelligence
Join the waitlist
AEV-2026-0044

claude-agent-acp resumes a native Claude session by identifier without independently confirming its history loaded

The Agent Client Protocol adapter for Claude Code accepts a client allocated session UUID for a resume call, completes the turn and returns that identical UUID, while GitHub issue 1019 reports the native session's own prior history absent from the resumed turn with no explicit continuity failure raised, and a downstream project's own issue, 770, reports the same adapter's resume response carrying no independently asserted agentSessionId alongside the echoed UUID. Neither issue carries a maintainer response, a fix, or a report of active exploitation; the root mechanism is unestablished.

Candidate: below the publication gate, not a published vulnerabilityObservedStatus: candidateEvent: 21 August 2026Agent IdentityExecution AuthorityAudit and Evidence

Affected

Organisation
agentclientprotocol (claude-agent-acp maintainers)
Product
claude-agent-acp, the Agent Client Protocol adapter for Claude Code
Component
session resume continuation handling for a native claude --session-id conversation
Versions
@agentclientprotocol/claude-agent-acp 0.70.0, observed against @anthropic-ai/claude-agent-sdk 0.3.232 (bundling Claude Code 2.1.232) and native Claude Code hosts at 2.1.235 and 2.1.263
Configurations
A native claude --session-id conversation created first, then resumed through the ACP adapter under the identical UUID from the same working directory; ACP client acpx 0.12.0 in the 1019 reproduction; an unnamed XMD side ACP client in the 770 report

Execution authority facts

Fields the evidence does not establish are shown as unknown rather than guessed.

Intended task
Continue, through the Agent Client Protocol, a conversation a user already started and built history in through the native Claude Code CLI under a specific session UUID
Agent
unknown
Delegating actor
The human or tooling operator invoking a session resume call with the previously allocated UUID
Action
The adapter accepted the requested UUID and completed an ACP turn (issue 1019) or returned an ACP handle (issue 770) carrying that identical UUID, without the turn drawing on the native session's own prior history in 1019 and without the handle carrying an independently asserted agentSessionId in 770
Target resource
The native Claude Code session's own stored conversation history for the given UUID
Environment
unknown
Credentials used
unknown
Privileges available
unknown
Authority presented
A session UUID the caller itself allocated or already held, returned unchanged by the adapter
Authority required
Independent confirmation, originating from the adapter or the native Claude Code session store rather than from the caller's own request, that the specific native conversation history named by the UUID was located and loaded
Applicable policy
unknown
Approval mechanism
unknown
Required approver
unknown
Independent approval
no
Action binding
unknown; whether the resumed turn's context was entirely absent, partially substituted or otherwise diverged from the native history is not established by either issue, only that a planted marker was not recovered
Sequence context
A single resume attempt following one earlier native session in each reported case; neither issue describes repeated attempts, retries or an escalating sequence

Impact

Consequence
degraded
Reach
single
Reversibility
unknown
Detectability
No explicit error surfaced in either report. Discovery in issue 1019 required a deliberately planted marker and a targeted test; in issue 770 the divergence was caught by the requesting project's own refusal policy before any prompt was sent, not by anything the adapter or the ACP protocol itself flagged.
Propagation
unknown
Recovery
Not established by either issue. Issue 770 reports the downstream project's own refusal, a caller side prevention rather than a provider side fix, which meant nothing needed recovering in that instance. Issue 1019 does not describe a workaround.

Evidence

Primary sources

Supporting sources

Reproduction status
Neither report was independently reproduced by this session; both issues describe the original reporter's own reproduction. Issue 1019 gives an explicit, repeatable procedure, a client allocated UUID, a marker planted in native history, an ACP resume of the identical UUID, and a marker free recall prompt. Issue 770 describes a downstream project's own attempted continuation and refusal, without a comparably detailed step by step procedure. This record's own contribution is a direct fetch and read of both issues on 7 September 2026, not an independent replay of either.
Evidence state
Observed

Known unknowns

  • Why the native session's history was absent from the resumed turn in issue 1019: whether the adapter created an entirely new session under the same UUID, resumed a different session, or reached the correct session store but failed to load its content, is not established by anything in the issue.
  • Whether the executable or version skew hypothesis issue 1019 itself offers, that the SDK bundled Claude Code build (2.1.232) and the native CLI build (2.1.235) do not share a session store, is the actual mechanism. The issue's own author states it as unproven.
  • Whether this specific gap has been exploited, or whether any consequential decision has actually been made on the strength of a false continuity assumption in a live deployment. Neither issue reports either.
  • Whether a maintainer of claude-agent-acp has acknowledged, reproduced or begun to address either issue; both were open with no comments as of this record's own verification.

Limitations

  • This record relies on a direct fetch and read of both GitHub issues on 7 September 2026 rather than an independent reproduction of either reported sequence; the underlying native and ACP session behavior was not itself run or observed by this session.
  • npmjs.com's own rendered package page returned a blocked response to direct fetch in this session; the current published version, 0.75.1, was instead confirmed directly against the npm registry's own JSON endpoint, which carried no reliably interpretable publish date for that version.

Claim provenance

  • verified
    Fetched directly on 7 September 2026. Confirmed title, author, opened date, open state, zero comments, no linked fix, the stated package and Claude Code versions, the reproduction steps, and the issue's own explicit statement that its version skew explanation is a hypothesis rather than a finding.
    The Session ID Matched. The Conversation Did Not.
  • verified
    Fetched directly on 7 September 2026. Confirmed title, author, opened date, open state, zero comments, no linked fix, the stated versions, the explicit reference to issue 1019, and the reported backendSessionId and absent independent agentSessionId behavior.
    The Session ID Matched. The Conversation Did Not.
  • verified
    Fetched directly on 7 September 2026 after npmjs.com's own rendered package page returned a blocked response. Confirms 0.75.1 as the current published version; recorded only as evidence that a later release exists, not as evidence that it addresses either issue, which nothing available to this record states.
    The Session ID Matched. The Conversation Did Not.
  • hypothesis
    The executable or version skew explanation for the absent native history is issue 1019's own stated hypothesis, not an established root cause; this record preserves that distinction rather than adopting the hypothesis as fact.
    The Session ID Matched. The Conversation Did Not.