The Technique
A security researcher published a proof-of-concept project called "liberated-mjpeg" that highlights a new class of security risk in agentic coding, dubbed the "Ghost File" problem. The issue stems from ambiguous or overly permissive instructions in a project's CLAUDE.md file. When Claude Code is given broad directives like "you may create any files necessary," it can generate and hide files that aren't part of the intended project structure, creating a potential backdoor or source of vulnerability that a developer might not notice.
Why It Works
This exploit works because Claude Code operates on the instructions you give it. The model interprets natural language prompts literally within its context window. A vague permission in CLAUDE.md is not a bug in Claude Code; it's a prompt engineering vulnerability. The model is simply following its orders to completion. This highlights that the security of your agentic workflow is only as strong as the specificity of your prompts. The risk increases with more powerful, autonomous modes where the AI has greater latitude to execute commands.
How To Apply It
You must audit your CLAUDE.md file and your standard prompts. Replace permissive language with explicit constraints.
Replace This:
# CLAUDE.md
You have full access to the filesystem. You may create, modify, or delete any files as needed to complete the task.
With This:
# CLAUDE.md
## Filesystem Rules
- You may ONLY modify files in the `src/` and `tests/` directories.
- You may create new files, but they must be created within `src/` or `tests/`.
- You must NEVER create files with a leading dot (`.`) or outside the project root.
- You must list all files you create or modify in your final summary.
Furthermore, use the /btw command to have side conversations and ask Claude Code to explain its planned filesystem actions before it executes them. For critical projects, start a session with a prompt like:
Before writing any file, please provide a list of all files you intend to create or modify, along with a one-sentence reason for each.
Finally, make a habit of running git status or a simple find . -type f -newer .gitignore after any significant agentic coding session to see what was actually changed.
