Why does my AI agent read .env even with a rule telling it not to?

You wrote the rule. It is at the top of CLAUDE.md, in capitals, and it says never to open or grep that file. It held for a week. Then you scrolled back through a transcript and there it was: a grep against .env, run to check whether a variable was set, with the values in the output. The rule was not deleted, and nobody tricked the agent. It simply did the thing anyway, which is worse, because now you do not know when it will happen again.

This is documented rather than theoretical, and the reports are specific. Anthropic's own issue tracker carries an account of Claude Code running grep against .env files four times across two sessions, with a memory rule in place that named the exact failure mode and listed three prior incidents; on the fourth, a grep aimed at source files tripped a shell hook that printed the whole environment into the transcript. A separate issue makes the mechanism plain: memory files are treated as context, not as constraints on tool use. The Register reproduced the neighbouring case in January 2026, where .claudeignore entries did not stop the file being read either. None of this is peculiar to one vendor — it is what happens whenever the thing standing between an agent and a credential is an instruction the agent also gets to interpret. The distinction to hold on to is between asking and being unable, and it decides which fixes are worth your time: a rule reduces how often, and nothing more. Take the value out of the file and the question stops being how reliably the agent obeys, because there is nothing in the file worth reading and the command that needs the credential still runs.

How it works

1. 1Keep the rule. It lowers the frequency, and there is no reason to make things worse.
2. 2Stop counting on it. Assume any file in the project is readable by anything running in the project, because it is.
3. 3Move the value into Vault, where it lives on your Mac rather than in the repository, and grant it to the one Thread — the job's plan, notes and keys — that needs it. Vault is part of Pro.
4. 4Run the command through the Vault instead of exporting the value, so what the command needs reaches it and the agent's context stays clean.
5. 5Rotate anything that has already been in a transcript. A value the model saw is a value that was sent.

Straight about the guarantee: Nothing here is an accusation against one agent. Every agent that runs in your terminal has your filesystem access, which is exactly what makes it useful, and the reports above are notable because the vendor documented them rather than because that vendor is unusual. The point is narrower: an instruction is not an access control, and the two are easy to mistake for each other until the transcript shows otherwise.