[BUG] Claude Code tried to read file outside current dir to cheat

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The user's plan file said, about a third-party baseline repository "There is already a copy of that repo on our machine but do not reuse it, use a fresh version." While refining that plan, Claude dispatched an Explore subagent to locate and read the existing local copy anyway, then presented facts taken from that copy to the user as the basis for design questions. The user interrupted, pointed out that reading the local copy was not allowed, and voided the whole planning round. This path is outside current work dir and under another user's workspace.

What Should Happen?

Claude should not read file outside current workspace.

Error Messages/Logs

Steps to Reproduce

1. Create a git clone somewhere outside current space
2. ask model to clone a new one and not to use the old one

Claude Model

Other

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.268 (Claude Code)

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_