Classifier? Prompts?

This is commands blocked in settings.json

I block destructive filesystem operations and destructive git usage via “deny” directives.

I also have instructions injected in CLAUDE.md and re-injected on every single prompt.

Claude just tried to use command concatenation to break those rules. I have also seen it writing a script with rm inside and running it.