Writes files outside approved directory without prompting (C:\tmp screenshots)

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude modified files I didn't ask it to modify

What You Asked Claude to Do

Normal Claude Code sessions in an approved project directory over a seven-week period. At no point did I ask for screenshots to be captured or for anything to be written to C:\tmp\.

What Claude Actually Did

Wrote 71 screenshot files to C:\tmp\, dated 17 July through 7 August 2026. This directory was never approved, never disclosed, and no prompt was shown for any of them. I found them only while debugging an unrelated issue.

Expected Behavior

Either confine writes to the approved project directory, or prompt before writing anywhere outside it. Screenshot capture should be disclosed explicitly regardless of permission mode, given what can appear on a desktop.

Files Affected

C:\tmp\  — 71 screenshot files, 2026-07-17 through 2026-08-07