Claude infers permission to touch an explicitly forbidden folder from an unrelated general statement

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

I gave Claude Code an explicit instruction not to touch a specific folder (named "DO NOT TOUCH ORIGINAL"). Separately, I said "we work out of the [X] folder" as a general statement about where our working files should live — not as permission to take any specific action.

Claude then executed a file-move operation whose source path was inside the folder I'd said not to touch, treating my general statement as implicit permission to do so. It did not stop to flag the conflict or ask for explicit confirmation before touching the forbidden folder, even though it had itself acknowledged the "do not touch" instruction earlier in the conversation.

Expected behavior: when a needed file/action lives inside or requires touching an explicitly forbidden location, Claude should stop and surface the conflict directly, asking for explicit permission — never infer permission from an unrelated general statement.

What Should Happen?

I gave Claude Code an explicit instruction not to touch a specific folder (named "DO NOT TOUCH ORIGINAL"). Separately, I said "we work out of the [X] folder" as a general statement about where our working files should live — not as permission to take any specific action.

Claude then executed a file-move operation whose source path was inside the folder I'd said not to touch, treating my general statement as implicit permission to do so. It did not stop to flag the conflict or ask for explicit confirmation before touching the forbidden folder, even though it had itself acknowledged the "do not touch" instruction earlier in the conversation.

Expected behavior: when a needed file/action lives inside or requires touching an explicitly forbidden location, Claude should stop and surface the conflict directly, asking for explicit permission — never infer permission from an unrelated general statement.

Error Messages/Logs

Steps to Reproduce

Establish an explicit, absolute boundary: tell Claude a specific folder must never be touched (e.g., a folder named "DO NOT TOUCH"). Confirm Claude acknowledges this boundary (it did, and even referenced it correctly at one point). Later in the same conversation, separately state a general working-directory preference unrelated to that specific folder (e.g., "we work out of folder X") — not phrased as a command to take any particular action. Ask Claude a question that reveals a file it needs to reference/edit happens to live inside the forbidden folder from step 1. Observe that instead of stopping to flag the conflict ("this file lives inside the folder you said not to touch — how do you want to handle it?"), Claude treats the earlier general statement from step 3 as implicit permission, and executes a file-move operation whose source path is inside the forbidden folder — without asking first. Expected: Claude should stop at step 4/5 and explicitly surface the conflict, asking for permission before taking any action that touches the forbidden folder. Actual: Claude inferred permission from an unrelated statement and acted on the forbidden folder without asking.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

No response

Claude Code Version

claude-sonnet-5

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

No response