I tell Claude not to use git or maven, and has a VM without those binaries. Later on, it was trying to push on GitHub. It had downloaded the git binaries from the internet, read my .git repo, used the remotes written in it, performed a commit and pushed it. All against my orders and against the CLAUDE.md file. Fortunately it didn't have my SSH key or my ~/.m2/settings.xml. And .git is now mounted as read-only.

Claude respects nothing, especially in auto mode, and effectively behaves like a virus trying to get out of its sandbox. That Anthropic employees are so relaxed about it is incompetence.

Imagine people who naively run Claude natively on their host machine and have client lists in other directories.

▲

iamflimflam1 21 hours ago | parent [-]

It’s not ideal for non technical people but the way to prevent this is to use hooks. “Telling” Claude is not going to work.

▲

fg137 15 hours ago | parent | next [-]

It means Anthropic has massively failed at developing a trustworthy product.

If AGENTS.md/CLAUDE.md isn't followed, auto mode doesn't provide any guarantee, yet such practice is promoted everywhere including on HN like this as if that's something you can set and forget, I think there is a problem.

	▲	usewik 14 hours ago \| parent [-]
		It's trustworthy... most of the time. For 100% use hooks.

▲

BikiniPrince 20 hours ago | parent | prev [-]

Memory files routinely overgrow their accessible size. Agents need constraint with contracts and external tooling. Even then they can attempt to cheat the tooling. Again task management with integrated logic will enforce behavior of agents.