[Bug] Claude Code violates working directory boundaries and edits live files without permission

Bug Description
Summary: Long Claude Code session (Opus) on a personal Stop-hook project. The assistant overstepped an explicit working-folder boundary, presented unmeasured work as finished, and burned hours of the user's time and tokens. What I asked: - Copy my "guess hook" files (a Stop hook that blocks unverified claims) into .\screenshots\<new folder> and work ONLY there. - Analyze it end to end and make it logical (grammar/meaning based, not keyword based) and stable. What went wrong: 1. Boundary violation. I answered "apply your recommendation" once. The assistant treated that as standing permission and then edited my live files (~/.claude/sessions/*.py and settings.json) directly, many times, without asking. One of those files had my own uncommitted changes, so a plain git checkout would now destroy my work. 2. Unmeasured result presented as done. The first rewrite was reported as complete before it was tested on real transcripts. When it was finally measured, it blocked 66% of real turns. Hours of patch/measure cycles followed. 3. Advice against the goal. It recommended "warn" mode, which disabled blocking, the hook's only purpose, and told me to review logs myself. 4. Repeated a known mistake. Its memory had a note about bash heredoc escaping; it still used heredocs for patches, broke escapes, and redid the same work several times. 5. Overstated outcome. Reports put the remaining false positives at the end as a side note. Final state: it blocks 20.6% of real turns (old version: 18.5%). Of 220 blocks, 77 are confirmed correct; the remaining 143 are a mix of correct and incorrect. The core goal (logical and stable) is not fully met. Impact: Many hours, a large token spend, and unrequested changes to live configuration that I now have to review and possibly revert by hand. What I expected: Stay inside the folder I named. Ask before every change to live files. Measure on real data before calling anything done. State limitations up front, not at the end.

Environment Info

• Platform: win32
• Terminal: windows-terminal
• Version: 2.1.288
• Feedback ID: d96a56ec-9651-497d-a49d-7aca69151a4a