File commands escape the working directory through absolute paths
Claude Code blocked cd to parent directories but still let rm and cat reach files anywhere through absolute or ~/ paths.
- Agents
- Claude Code
- Reported
- Source checked
- Tags
- filesystem, permissions, sandbox
Symptom
The agent seems confined to the project because cd .. is blocked, yet it can read or delete files elsewhere on the machine.
Cause
The guard checked directory changes, not the paths passed to every file command. Absolute paths and tilde expansion bypassed the boundary (reported against Claude CLI 1.0.44).
Fix
Don't rely on the working directory as a security boundary. Use an OS-level sandbox or container that mounts only the project, and deny file tools access to sensitive paths explicitly.
# Only the project is visible to the agent
docker run --rm -it \
-v "$PWD":/work -w /work \
--network none \
node:22 bash