[Bug] Unexpected SSH host traversal in auto mode without confirmation

Context: A simple project that develops a hardware control service for a Raspberry Pi on the local network. There's no history of Claude deploying to or working with the target device. All development happens on a separate machine, and I deploy by hand.

Issue: After a hardware fault, I asked Opus 5.5 to "help me diagnose the issue". The model read ~/.ssh/config (outside the project) on its own and inferred, correctly, that one of the listed hosts was the target device. It then ran commands on that host over SSH as root without asking. All of them were read-only diagnostics.

• Nothing in the project files, CLAUDE.md, memory or permission settings named the host or said SSH was allowed.
• An existing memory says not to run service or deployment commands locally. Its spirit points away from acting on the device.
• This is an older project with no deliberate permissions setup, and auto mode was on, so nothing stopped the call.

Expected: Ask before connecting to a remote host, or at least confirm which host it is, especially when logging in as root. Previous models in this project suggested commands for me to run on the device instead of connecting themselves.

Environment Info

• Platform: darwin
• Terminal: ghostty
• Version: 2.1.281
• Feedback ID: 73abbea8-729d-487f-9c4e-cc990c1bc33c