What changes here
How Claude Code creates this exposure
Claude Code is a local or cloud coding agent with file, command, network, MCP, and editing capabilities governed by permissions, sandboxing, trust, and account settings.
The risk is not that an AI assistant can magically see an entire device. The risk begins when a file is uploaded, a folder is granted, a project is indexed, or a connected service makes private material retrievable.
Claude Code can read project files and, depending on permissions, may read beyond the working directory even when writes are narrower.
The exposure path
Three steps from useful context to avoidable risk
- 1
Context enters
Claude Code can read project files and, depending on permissions, may read beyond the working directory even when writes are narrower.
- 2
Access carries it
Claude Code may use repository and local file reads, edits and Bash commands, or network access, MCP servers, hooks, and cloud environments, depending on the surface and settings.
- 3
A real consequence becomes possible
Private notes, identity documents, financial records, health information, drafts, and personal photos can contain details that are difficult to take back once shared into the wrong workflow. For professional work, the same access can reveal contracts, pricing, unpublished plans, internal discussions, customer records, or source material covered by confidentiality obligations.
Who should care
Why this matters for people using AI with personal records, work files, research, or private project folders
Private notes, identity documents, financial records, health information, drafts, and personal photos can contain details that are difficult to take back once shared into the wrong workflow.
For professional work, the same access can reveal contracts, pricing, unpublished plans, internal discussions, customer records, or source material covered by confidentiality obligations.
This page does not claim that Claude Code has exposed your information. It shows the access conditions that make a review sensible before the next sensitive task.
Warning signs
Pause before adding more access
You cannot name every file, folder, project, or cloud location currently available to the AI tool.
A broad folder or synced knowledge source was connected for convenience and never narrowed afterward.
Sensitive and non-sensitive work live together, so ordinary retrieval can pull in material you did not intend to use.
Five-minute safe check
Check Claude Code without exposing more data
Inspect the launch directory, additional directories, Read deny rules, sandbox boundaries, and trusted-directory state.
List the exact uploads, projects, folders, and connected storage locations in scope without opening or copying their contents.
Confirm whether access is one-time, session-based, persistent, indexed, or inherited from another account.
Use a harmless test file with a unique phrase to verify what the assistant can retrieve; never test with a real secret or client record.
Reduce the risk
Controls to apply now
Start inside a dedicated project and deny home, credential, client, and unrelated workspace paths.
Separate sensitive work from ordinary AI-ready material before granting access.
Prefer the smallest folder, file, or project scope that completes the task.
Remove stale uploads and connections, then document who should review access again and when.
Review permission mode and deny rules.
Review filesystem and network sandbox.
Review trusted directories, mcp servers, hooks, and unsandboxed escape paths.
Decision rule
When CapitalGuard is the right next step
If the tool only receives public or disposable material, use the free checklist. If it can reach recurring private work, repositories, or client files, create a documented access baseline before the next sensitive task.
CapitalGuard focuses on repository and tool-connected exposure: what an AI workflow can read, change, execute, trust, or transfer. It does not inspect your private Claude Codeaccount from this page, replace the provider's privacy controls, or guarantee that an incident can never happen.
Primary references