Fair question.
You have reasonably fine control based on your comfort level.
You can run it just in the chat surface where it walks you through, but you type any command. That gets tedious.
So you progress to giving it read-only access, where it can look around and fact-find, but you still have to execute every change. You then progress to where you allow it to make changes itself, but you have to approve every command before it does something (assuming of course that it’s honest about asking).
Eventually you get prompt fatigue, and you progress to editing your settings.json file, where you spell out very specific rules for which things are auto-approved. You can drill that down to specific bash commands, folders, etc.
Not any different from how you develop trust with teammates, or other software we use. Including ourselves. Not hard to write a buggy bash script yourself that might do more harm than you anticipated.
Of course, you’re still letting an LLM access your system, and certain information about your environment makes it into the cloud, which could be verboten.
You can get around that by pointing Claude Code at a local model, and if paranoid, even a local model made by a trustworthy entity (e.g. NVidia).
Earlier this week I ran a comparison of running an identical coding prompt through the Claude Caude harness, where in option A it used the native Opous-5 model, and in option B it ran with a 120B NVidia Nemotron local model. In the latter case, no data left the premises, and you could do this air gapped if you needed.
There are options based on your requirements. Over time, we build a better understanding of the risk/reward and the mechanism.
I often use local models for sensitive content. When I give prompts with screenshots I don’t want to get to the cloud.
ps: Command execution is handled by the harness, which is traditional code. The LLM is the one that figures out what the commands are. So it comes down to whether you trust Anthropic as much as you might trust Microsoft? Seems somewhat safe. Do you trust OpenAI as much? Some mathematicians may have opinions on that. Do you trust Grok? Others? YMMV.
ps: Apparently Anthropic may be a lower risk than your LG screen in the suite based on some recent news stories when it comes to exfiltration. Trust is becoming very complex these days.