Claiming the group task

Hi Team,
I have exposed a activity to one group using below code in TaskListener
delegateTask.addCandidateGroup(“XXX”);
This tasklistener fires when task get created

Question:
I observed, person who is not part of this group also able to claim from Comunda Tasklist screen.

According to BPM this is not the actual behavior.

I also tried by changing bpm-platform.xml by adding below property:
TASK_WORK
and restarted server but no luck.

Note:
Im curretly using camunda hosted on top of tomcat.