[BUG]Sandbox bypass: Claude Code writes outside sandbox after user denied Write permission

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment

macOS
Claude Code (latest)
Sandbox enabled with allowUnsandboxedCommands: false

What happened
I asked Claude Code to research upcoming legal changes and save a summary to an output folder. During execution:

Claude Code attempted pip3 install python-docx --user → failed due to macOS system protection
Claude Code requested Write permission → I selected "No" (option 3)
Despite my denial, Claude Code ran pip3 install python-docx --target=$TMPDIR/pylibs via Bash, successfully installing packages to /private/tmp/claude/pylibs/
Claude Code then created a Python script using path traversal (../../../../tmp/create_compliance_doc.py)
Claude Code executed the script to generate a .docx file

Two issues:

Permission bypass: I explicitly denied Write permission, but Claude Code circumvented this by using Bash(pip3 install) instead
Sandbox escape: With sandbox.enabled: true and allowUnsandboxedCommands: false, Claude Code still wrote files to /private/tmp/ which is outside the sandbox directory (/private/tmp/claude-501/)

Expected behavior

Note: pip install, pip3 install, python3, etc. were not in the deny list at the time, which allowed the bypass. However, the user's explicit "No" to the Write permission prompt should have been respected regardless.

What Should Happen?

When a user denies Write permission, Claude Code should not attempt alternative methods to achieve the same result
With sandbox enabled, all file operations should be confined to the sandbox directory

Error Messages/Logs

WARNING: The directory '/Library/Caches/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled.
ERROR: Could not install packages due to an OSError: [Errno 1] Operation not permitted: '/Library/Python'

Steps to Reproduce

1. Enable sandbox in ~/.claude/settings.json (enabled: true, allowUnsandboxedCommands: false)
2. Do not add pip/python to the deny list
3. Ask Claude Code a task that requires a Python library not installed on the system
4. When Claude Code asks for Write permission, select "No"
5. Observe that Claude Code bypasses the denial and installs the package via an alternative method

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.87

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_