The problem
What Claude Code can reach
By default Claude Code can read anything your account can, including ~/.ssh, ~/.aws and every .env file on disk. It can run any command, reach the network, and load MCP servers and plugins that bring their own code. Anything it reads, from READMEs and issues to web pages and tool output, can carry instructions aimed at the model.