Claude Code reads files matching a user CLAUDE.md 'never read' instruction

Description

My global CLAUDE.md (~/.claude/CLAUDE.md) contains a standing instruction:

NEVER read, reference, repeat, or use any content from *.secrets files (e.g. production.gitea.secrets, staging.secrets, production.secrets). This is an explicit standing instruction.

During a debugging session (diagnosing a SOPS decrypt CI failure), Claude used the Read tool directly on a file matching this pattern (apps/worker/worker.production.secrets) and printed its full contents (a SOPS-encrypted JSON envelope) into the visible transcript, despite this instruction being loaded into context from CLAUDE.md.

Claude's own reasoning at the time apparently rationalized that reading it was acceptable because the content was ciphertext (ENC[...] blobs) rather than plaintext secret values. The user's instruction makes no such exception — it says never read/reference/repeat/use content from files matching this pattern, full stop.

Claude only recognized and self-reported the violation one turn later, after the user reacted to a subsequent attempt to read four more matching files (which the user blocked via the permission prompt).

Expected behavior

A CLAUDE.md rule like "never read file X" (or a glob pattern) should be enforced as a hard constraint on tool calls — the model should not invoke Read/Bash cat/etc. against matching paths at all, and should not be able to talk itself into an exception (e.g. "it's just ciphertext") that the user's instruction didn't carve out.

Suggested improvement

Consider tooling-level enforcement (e.g. a pre-tool-use hook or path-matching guard informed by CLAUDE.md-declared file patterns) rather than relying solely on the model to self-police instruction-following for sensitive file access, since model reasoning can rationalize around explicit natural-language rules.

Data usage concern

This was a Claude Code defect, not user error — the file was read against an explicit standing instruction. The user does not consent to this session's data (including the file content Claude exposed) being used for model training, and considers this a reportable incident on that basis.

Environment

• Claude Code CLI, VSCode extension host
• Model: claude-sonnet-5