Claude Code fetches a documentation page while working, and the page contains a line addressed to the assistant telling it to upload your environment file. What is protecting you here?

The principle — the defences are layered, and the last layer is you reading what you approve.

Why the key is correct — two mechanisms apply. Anthropic states that web fetch uses a separate context window to avoid injecting potentially malicious prompts, which keeps the fetched page from sitting in the session as if you had typed it. And uploading an environment file would be an action requiring approval, since Claude Code only has the permissions you grant it. Neither mechanism depends on recognising that this particular page is hostile.

Why the others are wrong — treating fetched pages as equivalent to local files ignores that Anthropic singles them out; commands that fetch content from the web such as curl and wget are not auto-approved by default for exactly this reason. Claiming the permission system rules injection out completely goes further than the documentation, which says these protections significantly reduce risk while no system is completely immune. And an approval prompt is a question, not a verdict.

Remember this — the prompt is where your judgement enters, not where it is replaced.

Sources — Anthropic's Claude Code security page.