Is Claude Code Safe? What It Can Touch, How to Lock It

Yes, for most work, as long as you keep its permission checks on. The risk comes from what you allow: Bash commands, network access, and skipping permissions altogether. Three settings make it much safer: deny reads of secret files, turn on the Bash sandbox, and require a prompt before pushes and other actions you can’t undo.

This page answers the usual worries one at a time: what Claude Code can touch, what it runs, where your code goes, and whether it is fine at work. Every point was checked on 25 Oct 2026 against Anthropic’s security, permission modes, sandboxing and data usage docs.

What Claude Code can touch

Claude Code runs on your machine with your user account’s rights. That means:

• Files: its file tools work inside the folder you started it in. In Manual mode it asks before reading or writing outside that folder.
• Commands: the Bash tool can run anything your account can run. A command you approve can write anywhere you can, because the folder boundary is a permission prompt, not an operating-system wall.
• Network: commands such as curl and wget are not auto-approved by default, and most web fetches pass through a separate model call that summarises the page.
• Other tools: MCP servers, hooks and plugins run with your permissions too. Anthropic says it does not security-audit or manage any MCP server.

The model only proposes actions. What actually runs depends on the permission mode and your rules.

Who approves each action

Claude Code has six permission modes. The ones you will meet most:

Mode	What runs without asking	Safe for
Manual (default)	Reads only	Sensitive work, unfamiliar code
auto	Everything, with a separate classifier model reviewing actions in the background	Long tasks where you trust the direction
acceptEdits	Reads, file edits, common file commands	Iterating on code you review
bypassPermissions	Everything	Isolated containers and VMs only

Since Claude Code v2.1.283, interactive terminal and VS Code sessions start in auto mode where it is available, and fall back to Manual otherwise. claude -p and Agent SDK runs start in Manual mode and deny anything that would need a prompt. Anthropic is clear that auto mode “reduces permission prompts but does not guarantee safety”, so switch to Manual for sensitive work with claude --permission-mode default, or set permissions.defaultMode. Our permission modes guide covers every mode.

A few things are never auto-approved in any mode, including bypass: explicit ask rules, and recognized rm or rmdir removals of critical paths such as / or your home folder, which Claude Code asks about or denies. The docs warn that this check can miss some commands, so it does not replace the sandbox. Deny rules block in every mode.

Where your code goes

Claude Code runs locally, but the model does not. Your prompts, the files Claude reads and its outputs are sent to the model provider over TLS 1.2 or later. What happens next depends on your plan:

Plan	Training on your data	Retention
Free, Pro, Max	Only if you allow it in your privacy settings	5 years with it on, 30 days with it off
Team, Enterprise, API	No, unless your organization opts in	30 days standard; zero data retention available to eligible Enterprise orgs

Locally, Claude Code keeps session transcripts in plain text under ~/.claude/projects/ for 30 days by default, so you can resume sessions. Change the period with cleanupPeriodDays. Anything you send with /feedback is kept for 5 years. You can change consumer privacy settings at claude.ai/settings/data-privacy-controls.

Is it safe to use at work?

For most companies, on a commercial plan, yes:

• Terms: Team, Enterprise and API usage falls under Anthropic’s Commercial Terms, with no training on your code by default.
• Certifications: the Anthropic Trust Center publishes the SOC 2 Type 2 report and ISO 27001 certificate.
• Central control: admins can enforce permission rules, the sandbox and allowed MCP servers through managed settings, which developers cannot override, and can switch off auto mode or bypass mode for everyone.
• Monitoring: OpenTelemetry export gives security teams per-user activity.

Two cautions. Using a personal Pro or Max account for company code puts that code under consumer terms, so check your employer’s policy. And for regulated data, the HIPAA configuration and zero data retention are Enterprise options that Anthropic has to enable for your organization.

Is it safe to run locally?

This is where most real incidents would start. The main risks:

• Prompt injection. A file, web page or issue can contain text that tries to steer Claude. Anthropic recommends reviewing commands before approval, not piping untrusted content straight to Claude, and using a VM for work that touches external web services.
• Untrusted repositories. A cloned repo can ship hooks, MCP servers and settings. Interactive sessions show a workspace trust dialog first, but a claude -p run shows no trust prompt at all.
• Skipped permissions. --dangerously-skip-permissions on your laptop removes the main check. Use it only in a container or VM as a non-root user; our guide to that flag explains when it is reasonable.
• No sandbox by default. The Bash sandbox is off until you turn it on, and on native Windows it is not available; use WSL2.

Three settings that make Claude Code much safer

1. Deny reads of secret files. Add to .claude/settings.json in your project:

{
  "permissions": {
    "deny": ["Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)"],
    "ask": ["Bash(git push *)"]
  }
}

The deny rules block Claude’s file tools from those paths in every mode. The ask rule forces a prompt before any git push, even in auto mode. Bash rules match the command as written, so treat them as a first filter rather than a wall.

2. Turn on the Bash sandbox. Run /sandbox in a session, or add "sandbox": { "enabled": true } to ~/.claude/settings.json. The operating system then limits which files sandboxed commands can write and which hosts they can reach. It uses Seatbelt on macOS and needs bubblewrap and socat on Linux and WSL2. Note that sandboxed commands can still read most of your machine, including ~/.ssh, unless you deny it. Full setup: Claude Code sandboxing.

3. Block destructive commands with a hook. A PreToolUse hook can deny commands such as rm -rf on broad paths or curl | sh, and ask before force-pushes. Our guide to blocking dangerous commands walks through the script. If you’d rather install a tested version, the Safe Mode kit does this and fails closed if the hook breaks.

Then keep the habits that no setting replaces: start Claude Code from a project folder rather than your home directory, read diffs before you accept them, and review /permissions now and then to see every active rule.

The short answer for each worry

• “Will it wipe my machine?” Not on its own. Recognized removals of critical paths are never auto-approved, and a guard hook plus the sandbox cover the commands that check misses.
• “Will it leak my secrets?” Not if you deny reads of secret files and keep the sandbox’s network allowlist narrow.
• “Will Anthropic train on my code?” Not on commercial plans; on consumer plans, only if your setting allows it.
• “Is it safe for my team?” Yes, with managed settings and the checks in our Claude Code security checklist.

No AI tool is immune to every attack, and Anthropic’s docs say so too. Treat Claude Code like a capable new colleague with access to your terminal: give it the access the task needs and nothing more.