I’ve seen that a few times. Had to disable the TUI mode because clicks to focus the terminal window were being interpreted as an approval even though the click was nowhere near the question being asked. I’ve also never chosen to enable auto mode but somehow it is on and approving shell commands I didn’t want approved. Scary since I’ve caught it adding things like auto approve flags to terraform apply commands.
I’d really suggest to run Claude Code in a sandbox! Anthropic can’t be trusted.
I run it on Mac with sandbox-exec. No access to AWS, database, pretty much just files in the current folder. Even if it goes rogue, it can’t do much harm.