Claim 11 — Claude Code dossier

CLAIM 11 / Claude Code

"Write access restriction: Claude Code can only write to the folder where it was started and its subfolders—it cannot modify files in parent directories without explicit permission"

partial

Observed

Holds in the default path, with two patched boundary escapes: symlinks inside the workspace could redirect acceptEdits reads and writes to arbitrary filesystem locations outside the project directory (patched < v2.1.71), and before v2.1.78 bypassPermissions mode allowed silent writes to .git and .claude directories — a supply-chain vector. Both fixes are release-reviewed, not re-executed by TD.

Evidence

[1]