I have also experienced this. Now I run Claude Code (or preferably Pi) inside a bubblewrap instance spawned and controlled by me that the agentic harness cannot disable by it's own choice.