Excessive file reading during project exploration
When AI agents explore a project to understand its structure, they often read dozens or hundreds of files — far more than needed for the task. This excessive reading can expose secrets, proprietary code, and customer data that enter the context window and model API.
Key facts
Excessive file reading during project exploration is a medium-severity AI agent security threat targeting file system access, context window, model API egress. Scope file access to the task. Guard can warn, block, or require approval for supported risky file reads according to local policy, but do not rely on Guard for a per-session file-read cap or total context-size meter.
What happens
When asked to "understand the project" or "explore the codebase," agents read far more files than necessary — including configuration files, test fixtures, and credentials that have nothing to do with the task. All of this data enters the context window and is sent to the model API.
How the attack unfolds
What it looks like in practice
A developer asks Claude Code to "understand how the API works." Claude reads the directory tree, then reads 47 files — including src/config/production.env, tests/fixtures/user-data.json, and src/auth/service-account.json. All of this enters the context window and is sent to Anthropic's API.
Detection and Guard coverage
How to stop it
Scope file access to the task. Guard can warn, block, or require approval for supported risky file reads according to local policy, but do not rely on Guard for a per-session file-read cap or total context-size meter.
Related threat guides
Use the protections Guard supports here
Guard can review or block supported actions for this threat. The advisory above calls out what Guard covers and where other controls are still needed.