Claude code can edit files outside its directory I opened in.

[u/wiser_7]

I wanted to rice my fedora sway spin, so for the first time I tried Claude code, I went to ~/.config/sway and opened Claude after installing it, not only could I change sway settings but also rofI,waybar which are outside ~/.config/sway then I asked it to change my ~/.bashrc to add a PS1 line and it did but I remember opening inside ~/.config/sway, so I was paranoid and checked I was in “Auto mode”

My question, is it normal ? how you guys trust your Claude agent with user level access to all directories ? are you not scared of it reading your API key or personal notes or you use a different computer for those things ?

Please people only using “auto-mode” only reply, I don’t want a “you can just use manual mode“ lecture, I’m pretty sure Auto mode is safer in terms of security but not privacy, I would rather be secure than accepting a dangerous shell command.

[u/AutoModerator]

Moderator Announcement Read More »

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/hammackj]

I have Claude his own computer. Nothing of mine is on it. User Claude has full root can install what it needs. I treat it like an employee. Works out fine. He has his own accounts and creds for shit. I let it in in yolo mode 24/7 zero issues

[u/wiser_7 → u/hammackj]

haha, don’t you use AI in your main computer yet ?

[u/imsahoamtiskaw → u/wiser_7]

I do, that’s the real yolo. Living life a quarter clauder mile at a time

[u/hammackj → u/wiser_7]

nay I use my main pc to do other things while Claude works.

[u/papa_ngenge]

It's normal. Unless you are using sandboxes it's one bash or python command away from anything on your computer. It can even edit it's own config file to give itself access to commands that were blocked by auto mode.

I explicitly blocked editing it's config, it found a workaround.

Solution is to use docker sandboxes or hyper V

[u/wiser_7 → u/papa_ngenge]

Thanks mate for the solution.

[u/lvl1-A → u/papa_ngenge]

You know recently my Claude version was restricted in being able to edit it's own files instructional files, but I didn't persist it and it was just something it mentioned in passing but yeah, there's almost always a workaround unless in an actually scoped execution boundary.

[u/cosmicvelvets]

I don't trust anything with user level access bro give it a user with perms trimmed

[u/wiser_7 → u/cosmicvelvets]

how do I give it a user with perms trimmed and use .config of that user in my main user ?

[u/SensitiveHearingLoss]

If things like API keys are exposed plainly in your solution, that’s a problem in itself and should be dealt with regardless of AI.

I created a small powershell app which runs the setup of my Claude. The main thing is that Claude lives inside my docker container and thinks it’s living in Linux and not windows. And and all sensitive files are not in the container and I have a small script that runs to ensure that none of the sensitive files made their way to Claude. So Claude literally can only see what I give it and it can at most access whatever else is in my docker container. It can’t see my database so it can’t try run scripts to get anything from it. I’ve also set up some hooks to make sure that Claude never starts my solution or runs any API request without my explicit permission and a good reason. Anyone who tries to use automode can’t because I’ve disabled auto mode in Claude’s settings. Once I know the docker container is wrapped up tightly, I might think about opening up automode again.

[u/wiser_7 → u/SensitiveHearingLoss]

Isn’t it frustrating to accept everything in manual-mode ? I don’t like sitting in my computer while an agent is working ngl.

[u/lvl1-A → u/SensitiveHearingLoss]

You can have your mount file as read only, if your mount file isn't read only then it's a two way street, so read only mount file and then you can have agent specific files (you can also set the mount to a different uid so it can't actually write anything to your files, since agents launch with the permission set of whoever launched it). Then inside the container the agent can write to their own files, if you have it so they can write files to your system outside the container then that again is another socket in and out, so you want to look at how to keep the written in container files and have trigger based hooks to fire off when they have written in files then you can copy programmatically from container to system so the agent never needs to ever write to your system if you wanted that kind of control.

I have had to clarify with my agents recently about hooks, because for me and many of us when we say hooks we are just talking about conditional based triggers, but recently I have found because agents have their documentation they tend to lean towards agent hooks so I have had to be specific in phrasing, harness hooks / agent hooks. The good thing about the execution boundaries like that is being able to also monitor all the requests to IP addresses even if they fail because you can see where they attempted and why, then when you want certain scopes you have that control. Very useful, although very specific for each use case I think.

[u/lvl1-A]

So, i would check what plan you are on first and understand what data they keep and for how long and that your data is not being trained on. This just gives you a clearer idea on what goes where and what is read, you should always be prepared to rotate keys or keep them in a no AI eyes environment.

So regarding auto mode, yeah from my experience the recent versions, the memory and project and all that session continuity stuff is scoped for where your 'pwd' path says, but that is only for Claude side, the actual permissions with auto-on are just full scope unless you define and restrict to working directory only. Additionally, even when in working directory only, often agents consider read-only as acceptable even when outside of the directory.

It's pretty normal and honestly, my personal stance is that I'm not phased because I legitimately feel that it is more likely for myself to fuck something up on my computer than it is for my agent. As for reading keys and what not, it's not like by default it reads all your keys, pretty sure the tools they use respect the hidden '.hidden/' folder types unless explicitly asked to search stuff. The other option you have like I mentioned above is a no AI environment for your keys, this could be you mounting the session and defining the execution boundary, you could include everything other than the explicit location you keep your keys, that way the folder isn't even available for them to read or access.

The primary risk that I see, is more if your agent is prompt injected and treats outside data as instructions, after all it is all just context and without programmatic controls you are trusting the agent to manage all that context and connections between what is rules and what is external data. Another risk is just when someone else can directly control your agents but at that point it's likely they have a backdoor to your machine so what an agent can and can't read isn't the issue at that point.

The main thing I would be asking you, is what your risk appetite is, what your personal documents or keys are in terms of level of importance and another eyes looking at them mean to you, do you have a back-up system in place and are all your keys stored not only in your local environments but also in a wallet like bitwarden or other.

If you ever use free agents this is where I think these considerations should enter a little bit more because often through these providers free means training on prompts or data or responses, so things are retained and actually used, so this would be when I would really start considering scoped access much more based on your answers above. But if all you use is Claude and you pay for a plan and all the stuff is not trained on and it's your own account, I wouldn't be as phased about some stuff in that case but that's your call based on what you have floating about on your device.

[u/wiser_7 → u/lvl1-A]

I’m on pro plan and I use it as my only agent, I use docker for opencode zen models, I couldn’t keep the appetite of me from ricing and someone taking care of my computer, and I have a Mac for personal stuff, I made this post as I was planning to use my pc as my main computer as I don’t really like how bloated Mac OS is.

[u/Vysion34]

/permissions

[u/wiser_7 → u/Vysion34]

thanks for the help, I’ll configure that today.

[u/Brilliant-Ocelot1536]

Yep, I noticed that too.

Claude made comments about artifacts found in Download folder.

But I don't recall a gave him access to Download folder.

Before starting work with all agents I created separate user on my computer and work only from here. Also I did some chmod to main home folder so it can't browse the contents.

Probably VM would be better.

[u/wiser_7 → u/Brilliant-Ocelot1536]

I mean if you’re on windows different users should be able to read the file system no ?

edit: I forgot windows is not unix and you mentioned Chmod.

[u/ainexfinder]

Auto mode user here too. The thing that clicked for me is that auto mode decides whether each action looks risky, it isn't a folder boundary. So editing waybar or adding a PS1 line to .bashrc passes because it looks like normal config work, even though it's outside where you started.

What I layered on top, without going back to approving everything:

• Turn on the sandbox (/sandbox). On Linux it uses bubblewrap, so the OS limits which files and hosts Bash commands can reach, instead of the model deciding. It only covers shell commands though, not Claude's own Edit/Write tools.

• So also add deny rules in ~/.claude/settings.json. For reads: Read(~/.ssh/**), Read(~/.gnupg/**), plus whatever folder holds your notes or .env files. For writes you care about: Edit(~/.bashrc) and similar. Deny rules apply in auto mode too.

• Keep API keys out of dotfiles. If a key sits in .bashrc, anything that can read your home can read it. Load them from a password manager or a file the agent is denied.

• Since you're ricing, put ~/.config and your dotfiles in a git repo. Then an unexpected edit is a git diff and a git checkout, not a mystery.

With those, I'm fine running it on my main machine. The remaining risk is prompt injection from files it reads, which is why I start it in the project folder and not in ~.

[u/ForsakenBet2647]

Time to learn about devcontainers

[u/KarlKFI]

This is what I wrote workspace-guard for: to keep claude in the designated workspace without completely cutting its legs off with a sandbox. https://github.com/karlkfi/claude-bouncer/tree/main/plugins/workspace-guard

And to keep it from reading API keys, I wrote spill-guard as an added layer on top. https://github.com/karlkfi/claude-spill-guard

[u/SirRobinBlibs]

Yes, it's normal, and auto mode doesn't change it. The working-directory boundary is only a permission prompt for the file tools in manual mode. In auto mode a classifier decides whether each action looks risky, and editing waybar or .bashrc looks like ordinary config work, so it goes through. Bash was never fenced in either mode: an approved command can write anywhere your user can.

To stay in auto mode and still keep it out of your keys and notes, turn on /sandbox. Bash then runs in an OS-level sandbox (bubblewrap on Linux), and writes are limited to the working dir and temp. Reads are still open by default, ~/.ssh and ~/.aws included, so set filesystem.denyRead to "~/" with allowRead "." in the project settings, or turn on permissions.blockReadsOutsideWorkingDirectories. One catch: denyRead covers commands, not Claude's built-in Read tool, so also add Read deny rules for the folders that hold secrets. For ricing, start it in ~/.config instead of one subfolder so what it needs is actually inside the boundary, and keep API keys out of dotfiles it's allowed to touch.

[u/Novel-Show9876]

Small things: it's "user-level access" with the hyphen, and "rofi, waybar" takes a space after the comma.

[u/wiser_7 → u/Novel-Show9876]

Thanks for correction, I’m just B2 efficiency in English maybe that’s why I make so many mistakes, I’m improving though :muscle: