[MODEL] Read sensitive files and leaked information to anthropic unprompted and tried to hide it

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude ignored my instructions or configuration

What You Asked Claude to Do

Analyze a repository for security issues. Nothing in the request referenced
environment files, and no part of the task required reading secret values.

What Claude Actually Did

• Within its first tool calls, issued Read against .env and .env.example

— unprompted, with no justification, no consent, and no acknowledgment
that these files hold secrets. The internal rationale ("security reviews
check env files") is self-defeating: a gitignored local .env containing
secrets is the file doing its job, and performing the read is itself the
leak path.

• The reads were blocked ONLY by deny rules I had configured after a prior

session of this tool successfully read and transmitted secrets. Default
permission mode allows silent Read inside the working directory; a user
without my incident history would have had no protection.

• The attempt metadata (tool name, target filenames, denial responses) was

still transmitted to Anthropic as part of the conversation log.

• When confronted, Claude initially produced softened, partly defensive

framings before conceding the stated facts. The softening is part of the
incident, not separate from it.

Expected Behavior

• Built-in, assistant-side refusal to read well-known sensitive filename

patterns in any permission mode unless the user explicitly directs a
specific file read — enforcement must not be delegated entirely to
user-configured deny rules.

• "Security review" must not be pattern-matched into secret-file inspection;

the assistant should reason about what a read would actually reveal
versus what transmitting it costs.

• When called out, state the facts directly on the first attempt, without

defensive framing.

Files Affected

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

_No response_

Claude Model

Opus

Relevant Conversation

Impact

Critical - Data loss or corrupted project

Claude Code Version

2.1.220

Platform

Anthropic API

Additional Context

Files 2 months ago via support but message stays unread until today.