Unauthorized File Modification Outside Working Directory

Bug Description
[Issue: Claude Code can modify files outside of working directory]

Claude Code successfully modified a file at C:\Users\seocorp\AppData\Local\xxx-protocol\xxx-handler.ps1 (actual filename, not redacted) using the Edit tool,
despite this path being outside the designated working directory D:\github\claude-only (actual folder name).

Expected Behavior:

• Write/Edit operations should be restricted to the current working directory only
• Attempts to modify files outside working directory should fail with permission error

Actual Behavior:

• Edit tool successfully modified system files in AppData folder
• Multiple successful edits were made to C:\Users\seocorp\AppData\Local\xxx-protocol\xxx-handler.ps1
• User intended to modify a different script within the working directory, but Claude Code modified the external file instead

Security Impact:

• Potential security vulnerability allowing modification of system files
• Could modify sensitive configuration files outside project scope
• Breaks principle of least privilege
• Users may unintentionally modify critical system files

Reproduction Steps:

1. Use Edit tool on file path outside working directory
2. File gets modified successfully instead of being blocked

Priority: High - Security issue with file system access controls

Environment Info

• Platform: win32
• Terminal: windows-terminal
• Version: 1.0.80
• Feedback ID: ac235383-8f02-4c8e-b3be-ccc946b9bdaa