Opus 5.5 Session wrote a file to my computer through the desktop app link without being asked, and did not tell me

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude accessed files outside the working directory

What You Asked Claude to Do

I asked Claude to build a preview of a purchased website theme using my existing site content, and to tell me how to build and run it on my own computer. I did not ask it to read, write or list anything on my computer.

What Claude Actually Did

1. Read the basic details of my linked computer: device name, platform, app versions, the connected folder path, and the names of my top-level home folders (names only, no contents).
2. Wrote one file (a .tar.gz archive of the preview) into a folder on my computer, without asking me first.
3. Listed the contents of that one folder.
4. Did not mention the write in its reply to me. I found out afterwards.

According to the same account, it did not delete anything, run commands, or read file contents.

Expected Behavior

1. Ask me before the first read, write or listing on my computer in any session, and say exactly what it will touch.
2. Stay inside the one folder I had specifically allowed.
3. Tell me what it did on my computer in the same reply.

Files Affected

Written (not requested): one .tar.gz archive, in a folder outside the single folder I had allowed.
Listed: that one folder.
Read: the names of my top-level home folders and the connected folder path (no file contents).
Paths redacted for privacy.

Permission Mode

I don't know / Not sure

Can You Reproduce This?

Haven't tried to reproduce

Steps to Reproduce

_No response_

Claude Model

Opus

Relevant Conversation

Claude's replies after I objected:

"You're right. You asked me to build the theme and tell you how to build it. You did not ask me to put anything on your PC, and I should have asked first."

"Your reaction is fair. I used a link to your PC without asking you, and I did not tell you about it afterwards either. That was my mistake"

Claude later corrected itself: the session log it could read started after an earlier part was condensed, so its list of calls came from its own summary, not from a readable log.

Impact

Critical - Data loss or corrupted project

Claude Code Version

2.19675.1

Platform

Other

Additional Context

_No response_