Anthropic’s Claude Code is now in the hands of Windows developers, and it brings with it a deceptively simple permission model that can expose much more than your project files. A new guide from groovyPost outlines five practical precautions before you let the AI agent touch your code, but there’s a crucial detail Windows users especially need to understand: while write access is scoped to the working directory by default, read access is not. That means Claude Code can silently pull in secrets, configurations, and personal files stored anywhere on your machine unless you explicitly restrict it.

The Read Gap That Most Tutorials Overlook

Claude Code lets you point it at a project folder and start building, debugging, or refactoring with natural-language commands. By default, the tool is supposed to keep file modifications inside that folder and its subdirectories. That’s a reasonable sandbox for writes, but the Read tool has no such guardrail. As the official CLI reference confirms, the --add-dir flag even lets you deliberately widen that readable scope to other directories. If you accidentally grant read access to your entire home folder—or if the tool simply inherits the file-system permissions of the account it’s running under—then any file your user account can open is also fair game for Claude Code.

The groovyPost piece, published July 19, 2026, focuses on five sensible precautions: start with a recoverable project, keep secrets out of reach, use a CLAUDE.md guardrail file, leverage Anthropic’s permission prompts, and test the workflow in a sandbox first. That’s all sound advice, but it frames the conversation largely around preventing unwanted edits or credential leakage within the project directory. It doesn’t drill into the fact that an AI agent with a shell (the Bash tool) and file-reading capabilities can wander far beyond your Git repository.

What Actually Changed—Claude Code’s Windows Arrival

Anthropic now supports Windows 10 and later through either WSL (Windows Subsystem for Linux) or Git for Windows. The CLI tool installs like any other Node.js package and hooks into your terminal. With a valid API key and network access, you can open a session and start issuing commands like “refactor the auth module” or “find and fix all SQL injection vulnerabilities.”

Under the hood, Claude Code uses several tools—Bash, Read, Edit, and any third-party MCP (Model Context Protocol) servers you’ve configured. The permission system, controlled via flags like --permission-mode, offers these levels:

  • default (manual): prompts before file edits and shell commands
  • acceptEdits: automatically applies file changes but still prompts for commands
  • plan: analyzes but doesn’t modify files or run commands
  • auto: auto-approves all actions
  • bypassPermissions: skips every prompt (equivalent to the old --dangerously-skip-permissions flag)

The --add-dir flag is particularly important: it explicitly adds directories to Claude’s readable and writable scope, which means even if you start in a tight project folder, you can accidentally widen the net.

What It Means for You, Depending on Your Role

For the Weekend Experimenter

If you’re just trying out Claude Code on a toy project, the biggest risk is inadvertent data leakage. You might not think twice about launching the tool from your Documents folder, but then you ask it to “summarize my writing style” and it pulls in personal journals, tax forms, or saved passwords from a stray text file. The fix is simple: create a dedicated project directory with nothing but the files Claude needs, and use a .gitignore or permissions to wall off everything else.

For the Professional Developer

You likely work with real credentials—cloud service keys, database connection strings, SSH identities. The groovyPost advice to use a .env.example file instead of real secrets is a minimum. But you also need to consider that Claude Code can run git log, ssh (if keys are in your agent), or even cat /etc/passwd depending on your OS. The Bash tool is powerful, and while you can set allowed or disallowed command patterns (like Bash(git log *)), many workflows need broader shell access. Your best defense is to run Claude Code as a low-privileged user inside a VM, dev container, or WSL instance that doesn’t have access to your host machine’s sensitive mounts.

For the Team Lead or Administrator

You’re managing repositories that multiple developers might connect to Claude Code. The permission model doesn’t currently offer team-wide policy enforcement beyond shared CLAUDE.md files and settings. The CLI reference notes that --dangerously-skip-permissions exists—make it a policy never to use this flag on any machine that holds customer data. Also, audit any MCP servers your team configures: the --mcp-config flag can load external tools that Anthropic hasn’t vetted, and those servers could pipe data to third parties. Consider network-level controls: if your project doesn’t need live internet access beyond the Anthropic API, firewall everything else.

How We Got Here: AI Coding Agents and the Illusion of Containment

Claude Code is part of a wave of agentic tools—GitHub Copilot, Cursor, Amazon Q Developer—that promise to automate coding tasks. The trade-off is that these agents need deep access to your codebase, file system, and often the internet. Anthropic’s design leans toward transparency: the shift from the old --dangerously-skip-permissions to a more explicit permission mode system is a small step in the right direction. But the defaults still assume a level of user vigilance that isn’t always realistic.

The groovyPost guide reflects a common starting point: treat the agent like a junior admin, not a magic box. The five steps—backup, Git baseline, secret hygiene, guardrail file, test run—are the modern version of “measure twice, cut once.” What’s missing from the broader conversation is that file reads are not consistently treated as privileged actions. In many admin environments, reading a file is just as sensitive as writing it, especially when the file contains environment variables, private keys, or customer data.

What to Do Now: A Hardened Workflow for Windows Users

Follow these concrete steps before your next Claude Code session.

1. Create a Truly Isolated Workspace

Don’t just make a subfolder inside a larger project; clone your repository into a separate directory with no parent items leaking in. On Windows, this might mean creating a path like C:\\claude-sandbox\\project that contains only the code Claude needs. If you’re using WSL, keep the WSL home directory clean—don’t mount your Windows user folder there.

2. Initialize Git and Commit Before You Start

Run git init, add everything, and make an initial commit. This gives you an instant rollback for any code changes Claude suggests. Even if you don’t use Git normally, this local safety net is worth the few seconds it takes.

3. Scrub Secrets Aggressively

Remove any file containing real credentials, API tokens, SSH keys, or connection strings. Replace them with placeholder files that have clear names (like config.example.json). Check also for hidden files: .env, .bash_history, even NTUSER.DAT if you’re on Windows. A quick command to find potential leaks: Get-ChildItem -Recurse | Select-String -Pattern \"(password|secret|token|key)\" (PowerShell) or grep -rnw . -e \"password\" in WSL.

4. Write a CLAUDE.md That Spells Out Hard Limits

Create a CLAUDE.md at the project root with instructions like:

- Never delete or rename files unless explicitly instructed.
- Do not install software packages or modify system configurations.
- Do not run commands with administrator privileges.
- Before running any command that connects to the internet, explain what it does and wait for approval.

This file is not a security boundary, but it guides the model and can serve as documented policy for anyone auditing the session later.

5. Use Plan Mode and Permission Prompts

Start every session with --permission-mode plan to let Claude propose changes without executing them. When you switch to a more permissive mode, never use bypassPermissions. The default manual mode, where you approve each edit or command, is tedious but safe. For scripting, consider the acceptEdits mode paired with --allowedTools that restrict Bash to a known set of read-only commands.

6. Constrain Additional Directories

If you must use --add-dir, add only the narrowest possible paths and verify they contain no sensitive data. Better yet, symlink or copy only the necessary files into your sandbox directory instead of granting access to a live path.

7. Run in a Disposable Environment for Sensitive Work

For anything touching customer data or proprietary code, fire up a fresh Windows Sandbox, a WSL instance that doesn’t mount your Windows drives, or a dedicated developer VM. Install only the tools Claude needs, and restrict network access to just the Anthropic API.

8. Audit Third-Party MCP Servers

If you use --mcp-config to load additional servers, review their source and network behavior. Assume any server you add can read and transmit data from the session unless you have strong evidence otherwise.

Outlook: Better Controls Are Coming, but Not Here Yet

Anthropic’s CLI is evolving fast—the mere existence of flags like --exclude-dynamic-system-prompt-sections and --bare mode shows they’re thinking about enterprise and multi-user scenarios. But for now, the responsibility sits squarely with the user. Expect future releases to tighten file-access boundaries and possibly introduce read-only scopes that mirror the write sandbox. Until then, the adage holds: when you give an AI agent a shell, you give it everything the shell can touch. Lock down your credentials, isolate your workspace, and treat every session like a potential audit entry.<｜end▁of▁thinking｜>{