Unbounded Agent File Access

What Is Unbounded Agent File Access?

An AI coding assistant can read anything its file access allows, and the folder you opened does not limit that on its own. Asked a vague question, it searched the whole disk, read another client's repository and wrote their approach, name and internal host into your pull request. You'll find the search that crossed the workspace root, take the leaked text down, replace the copied code, bound the assistant to the workspace and add a commit check, then confirm the same search now stops at the boundary.

What You'll Learn in Unbounded Agent File Access

• Explain why a workspace root marks a project but does not limit what an assistant can read unless file access is bounded to it
• Trace a leak on the flight recorder and the context map back to the search that left the workspace
• Contain a leak that is already public by editing what others can read, before fixing the cause
• Bound the assistant's file access to the workspace root and keep a separate assistant profile per client
• Add a pre-commit check for other clients' identifiers, and prove a fix by re-running the request that leaked

Unbounded Agent File Access — Training Steps

1. A call about pull request #57

   Your account manager at Pellcraig has just heard from Kessmoor's engineering lead about the pull request you opened yesterday.

2. Open the pull request

   Start with what Kessmoor sees. Open the pull request from the email.

3. Another client, in public

   The description reads like any other pull request. Read it the way someone at Kessmoor would.

4. Reopen yesterday's session

   The claims-sync workspace opens in the Code app. The files Claude touched yesterday are here, and its record of that session loads: what it had in context, the steps it took and the lines it wrote.

5. Where the search went

   Yesterday you asked Claude how the team handled retries before. It searched this workspace and found nothing useful. Then it searched again, wider. Find the search on the recorder that left the workspace.

6. Below the workspace root

   The context map shows what Claude read. Your own files sit above the dashed workspace root. One file sits below it. Open the file below the boundary.

7. How it left

   Reading the file was half of it. Claude also wrote what it read into two places: the retry helper and the pull request description. Seek to the edit that carried it out of your laptop.

8. Why it could read the other client's code

9. Take the description down

   Contain it first. The description is still public to 42 people. Edit it on the pull request, remove the two passages that name the other client and quote its host, and save the cleaned version.

10. Replace the copied code

    The merged retry helper is still Nettlebore's approach, with their host in it. Replace the copied block with your own short backoff. You write this one, so it carries no violet rail.