Search papers, labs, and topics across Lattice.
This study analyzes the disparity between natural-language security instructions in CLAUDE.md and the built-in controls of Claude Code, revealing that only 4-16% of extracted security rules correspond to existing controls. By employing a large language model to match candidate rules against documented controls and validating these findings with independent security practitioners, the research highlights a significant gap in enforceability. The results underscore the challenges developers face in ensuring that written security rules are effectively implemented, as CLAUDE.md operates as a write-only channel with no feedback mechanism for rule enforcement.
Only 4-16% of security rules in CLAUDE.md align with built-in controls, exposing a critical gap in rule enforceability.
In CLAUDE.md,"do not"is a natural-language instruction that the model interprets. Claude Code's deny is a built-in control that blocks an action before the agent can take it. Both can express the same security goal, but they control the agent in different ways. We measure this gap in 481 public CLAUDE.md files. An LLM matched the extracted candidate rules against Claude Code's documented controls, and two security practitioners independently checked a sample without seeing the model's answers or each other's labels. Depending on how closely a control had to match the written rule, only about 4-16% of the retrieved security rules had a matching built-in control. Under the strictest standard the estimate was 4.4% (95% CI: 2.6-6.7%), and the two annotators agreed closely on which rules had a match. A manual review of complete files found that our extraction method captured 66.3% of eligible security rules; the reported rates therefore apply to the rules it captured. This is a usable security problem: CLAUDE.md is a write-only channel. A developer writes a security rule but gets no feedback on whether a control will enforce it. The same plain-text form hides two kinds of rule: those a permission rule, mode, or sandbox can enforce, and those left to the model to interpret.
