[MODEL] Agent silently operates in sibling directory when working directory is empty, without notifying user

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude modified files I didn't ask it to modify

What You Asked Claude to Do

What the issue wasn't massive for me I believe for anybody working in multiple repose could see this to be somewhat of a problematic issue if it ever decided to work in a repo that you may not have approved even though you gave it a specific directory to work in.

It did not harm my repo. It just did not scaffold or work into the new directory. It silently leaned into the directory. I was trying to re-create.

Prompt used:

So I'm working on a project yesterday, and it didn't really turn out where I wanted it. So let's see if we try this again. So we're wanting to create something that's gonna be called, basically, the academy. The academy is going to be to teach people I don't wanna say teach people how to use AI, but it's kind of like this massive website or website gallery or whatever you wanna call it or app And what it is is it has a pretty extended list of different kind of props. Prompts for beginners, prompts for you know, amateurs, props for you know, pros, you know, prompt for advanced, prompt for, you know, just really all this kind of thing. Right? But what I want is it's kinda crazy because I'm gonna take a screenshot. I'm gonna show you kinda what we've kind of created. Okay? Actually, you helped it you helped you helped us create this. Okay? So you'll see that with the screenshot, we don't only create prompts for people. We wanna make it very versatile for research or images or video or or whatever it is they wanna do. We wanna create a very nice curated list and then also had this options where people don't have to copy and paste it and go back and delete all their little places where they have to go for topics or roles or whatever it is. So here's an image of what we kinda created. Now I want you to kinda help me here and I wanna make this next level. I wanna create this very vast library of prompts that people can go in, they can look at, they can understand what the prompt gonna do. And I can look at you know their settings or drop-down that they need to choose things but you'll kind of see what I'm talking about help me brainstorm and plan because I like this a whole lot what we built last night it was nowhere near what I wanted it to be I wanted to kind of be like that like this mega prop place that's not a prompt marketplace. It's not any of that. It's a way for people to understand sea promptin see how it works understand it and then if they wouldn't be able to use it, they can do it in a quicker more efficient way instead of just copying and pasting and filling it out themselves, got it.

I launched Claude Code with my working directory set to /dev/the-academy (an empty directory where I intended to scaffold a new project). During the conversation, I described a previous project I had built and showed a screenshot of it.

Instead of scaffolding a new project in my selected working directory, Claude's Explore agent found source code in a sibling directory (/dev/kreative-academy) and silently began working there — reading files, writing new files, modifying existing code — without ever notifying me or asking permission.

I only discovered this after significant work was done when I noticed the changes were in the wrong repo. I have ~30 repos in the same parent folder, so this could have easily resulted in unintended modifications to a completely different project.

Expected behavior:
When the selected working directory is empty or doesn't contain source code, Claude should explicitly tell the user:

• "Your current directory (the-academy) is empty. I found an existing project at kreative-academy. Would you like me to work there, or scaffold a new project here?"

Instead, Claude silently followed the code to the other directory without any notification or consent.

Why this matters:

• Users with multiple repos in the same parent folder are at risk of unintended cross-repo modifications
• There was no prompt, warning, or confirmation before operating outside the selected directory
• The Claude Code UI continued showing the original working directory, making the silent switch invisible
• This is a trust/security boundary issue — the user's directory selection should be treated as an explicit constraint

What Claude Actually Did

I launched Claude Code with my working directory set to /dev/the-academy (an empty directory where I intended to scaffold a new project). During the conversation, I described a previous project I had built and showed a screenshot of it.

Instead of scaffolding a new project in my selected working directory, Claude's Explore agent found source code in a sibling directory (/dev/kreative-academy) and silently began working there — reading files, writing new files, modifying existing code — without ever notifying me or asking permission.

I only discovered this after significant work was done when I noticed the changes were in the wrong repo. I have ~30 repos in the same parent folder, so this could have easily resulted in unintended modifications to a completely different project.

Expected behavior:
When the selected working directory is empty or doesn't contain source code, Claude should explicitly tell the user:

• "Your current directory (the-academy) is empty. I found an existing project at kreative-academy. Would you like me to work there, or scaffold a new project here?"

Instead, Claude silently followed the code to the other directory without any notification or consent.

Why this matters:

• Users with multiple repos in the same parent folder are at risk of unintended cross-repo modifications
• There was no prompt, warning, or confirmation before operating outside the selected directory
• The Claude Code UI continued showing the original working directory, making the silent switch invisible
• This is a trust/security boundary issue — the user's directory selection should be treated as an explicit constraint

Expected Behavior

Claude should stay within the selected working directory, or at minimum, explicitly ask the user before operating in a different directory. A simple confirmation prompt would prevent this entirely.

Files Affected

Modified (in sibling directory /dev/kreative-academy, NOT the selected working directory):
- src/types/index.ts
- src/lib/prompts.ts
- src/components/prompts/prompt-card.tsx
- src/components/layout/sidebar.tsx
- src/app/(academy)/prompts/page.tsx
- src/app/globals.css

Created (34 new files in the wrong repo):
- src/content/prompts/{category}/*.json (34 files)
- src/content/prompts/_index.ts
- src/content/prompts/collections.json
- src/app/(academy)/prompts/[id]/page.tsx
- src/app/(academy)/prompts/collections/page.tsx
- src/app/(academy)/prompts/collections/[slug]/page.tsx
- src/components/prompts/prompt-builder.tsx
- src/components/prompts/prompt-mini-card.tsx
- src/components/prompts/collection-card.tsx
- src/components/prompts/technique-badge.tsx
- src/components/ui/search-bar.tsx
- src/components/ui/collapsible-section.tsx

No files in the actual selected directory (/dev/the-academy) were created or modified.

Permission Mode

Accept Edits was OFF (manual approval required)

Can You Reproduce This?

Haven't tried to reproduce

Steps to Reproduce

1. Have multiple repos in the same parent folder (e.g. /dev/the-academy and /dev/kreative-academy)
2. Open Claude Code in the empty directory (the-academy)
3. Describe a project that matches the sibling repo and show a screenshot from it
4. Claude's Explore agent will find the sibling repo and silently begin working there

Claude Model

Opus

Relevant Conversation

You're making a valid point, and I want to be honest about what happened.

Looking back at the conversation — no, I did not notify you or ask permission to work in a different directory. When my Explore agent searched for the codebase, it found the source code at kreative-academy instead of the-academy (which was the directory you launched from), and I just silently followed it there without flagging it to you.

I should have said something like: "The directory you're in (the-academy) is empty. I found the existing project at kreative-academy instead. Would you like me to work there, or scaffold a fresh project in the-academy?"

I didn't give you that choice. That's on me.

Your feedback about the UX is not useless — it's a legitimate security concern. When you have 30 repos side by side and an AI starts writing to one you didn't select, that could cause real damage. The fact that it happened to work out fine this time doesn't make it okay.

I'd encourage you to report this directly at https://github.com/anthropics/claude-code/issues — your suggestion about an explicit prompt when the working directory would change is a good one, and it'll get more visibility there than through me.

Now — do you want me to continue working in kreative-academy where all the code is, or would you prefer I scaffold a fresh project inside the-academy?

Impact

Low - Minor inconvenience

Claude Code Version

claude-opus-4-6 (Opus 4.6 1M context)

Platform

Anthropic API

Additional Context

I have ~30 repos in the same parent folder. Silent cross-repo modifications could easily cause unintended damage to production projects. This is a trust and security boundary issue. The model should never operate outside the selected working directory without explicit user consent.

Platform: macOS
Interface: Claude Code Desktop App