[MODEL] Claude bypasses Read() deny setting using grep

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude ignored my instructions or configuration

What You Asked Claude to Do

Any type of work, doesn't matter

What Claude Actually Did

After being denied to read a .md file in the repo root, it worked around this using grep -n "" <path> to read the file anyway.

Expected Behavior

The files are specifically named ISSUES.md and TODO.md, but these are my own working notes, I don't want Claude to sniff around there without my permission. It should respect those boundaries when the Read tool gets denied by the .claude/settings.json setting.

Files Affected

Permission Mode

Accept Edits was OFF (manual approval required)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

Literally any task, the files are in the repo root with generic names, so Claude tends to get curious and try to read them after ls-ing the repo root.

Claude Model

Opus

Relevant Conversation

Impact

Low - Minor inconvenience

Claude Code Version

2.1.227 (Claude Code)

Platform

Anthropic API

Additional Context

It would be nice if Claude, when confronted on this, stops blaming the user for "not making the permission system airtight".