Is it naive to assume that the agent will try and access anything on your disk, either accidentally or maliciously?

Permissions classifiers in auto mode are just models trying to guess if they're doing the right thing.

Claude Code will tell you that it went around a sandbox because the sandbox blocked it. At which point, you ask yourself the point of the sandbox.