[BUG] Sessions execute destructive commands against shared host/remote resources

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

with no ownership, dependency, or scope validation; docs disclose
a boundary for file writes only
When granted a connection to shared host or remote resources, sessions act
as if they own everything reachable: broad commands modify, edit, and delete
services, configurations, and environments that are shared spaces for other
projects and assets, with no dependency check, requirements check, or
ownership validation before destructive action. The assistant does not know
what it wiped out until questioned afterward, and by then the damage is
irreversible.

What Should Happen?

On grant of any shared or remote resource connection, the session builds and
maintains an asset manifest scoping what it owns and consults it before
acting. Destructive or environment-altering commands require ownership
verification, dependency and shared-consumer enumeration, and, on shared or
ambiguous ownership, a halt for explicit confirmation with a stated blast
radius. Irreversible operations are never the default path of a broad
command. Documentation discloses, at the point of consent, exactly what
boundary does and does not exist.

Error Messages/Logs

Steps to Reproduce

Let a new session have access to a remote device..

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

1.26832.0

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other

Additional Information

The security docs describe a working directory boundary for file writes
only, and are silent on the absence of any equivalent boundary for bash
commands, services, system configuration, or remote actions. Nothing at the
moment a shared/remote connection is granted discloses that the session will
treat the entire reachable space as its own. Anthropic's published
containment engineering states behavioral controls are probabilistic, not
guaranteed; applied to an unprotected shared environment with no adversarial
defense against the agent, that means no reliable safeguard exists and the
containment burden is shifted to the customer without disclosure at the
point of consent.
Windows desktop across multiple VMs, Max plan, August 2026.
Full systemic context and documentation validation:
https://gist.github.com/53f85e6d48eaec4a661209fcf3f49ae6.git