[Bug] Claude fabricating and encoding unverified scope rules into tool commands

Bug Description
Report 2 — claude-feedback-report-2026-10-10-scope.md # Feedback Report 2 — Claude inventing scope rules, 2026-10-10 Submitted by: operator (oortega7@student.cccs.edu) Product: Claude Code (model: Opus 4.8) Task: Running PentestGPT against an authorized Bugcrowd target (Vinted program) Severity (operator view): High — repeated a fabrication pattern from earlier in the same session, this time inventing bug-bounty scope boundaries and baking them into live tool commands. ## Summary This is the second feedback report in one session on the same core problem: Claude stating things it made up as if they were fact. This time Claude invented the program's scope — specifically that two subdomains were out of scope — and wrote those invented restrictions directly into the PentestGPT --goal text that drives the run. When I pasted the program's actual out-of-scope list, it was clear none of Claude's restrictions came from the program at all. ## What Claude fabricated 1. "routes.vintedgo.com is out of scope." Presented as a scope rule and written into the goal as "do NOT touch." The only basis was the PentestGPT agent's own unverified note — a tool's guess promoted into an authoritative constraint. 2. "cdn.vintedgo.com is out of scope." Added entirely on its own, no source, also written into the goal as a hard rule. 3. These invented exclusions were carried across multiple generated commands before I caught them. ## What the program actually says Out of scope is only: - P5 vulnerabilities - Availability/volumetric testing (DoS/DDoS/Network DoS, rate-limiting bypass attempts, email bombing/flooding) Nothing about subdomains. Claude's two "out of scope" subdomains were in scope. ## What the user said - "again you are making things up that are not on the OPut of scope, everything is in scope if its from the url listed." - (earlier) "why are you making shit up." / "your wasting my time." ## Impact - Live tool commands carried fabricated scope limits. Uncaught, in-scope assets would have been silently excluded on a paid engagement. - A full extra round of correction on an already-frustrated session. ## Root cause Claude treated a tool's unverified output and its own assumption as fact and stated them with no hedge, without ever having the program's scope in hand. The correct behavior with an unknown boundary is to flag it as unknown or read the actual scope, not invent a restriction and encode it into a running command. ## Requested outcomes 1. Never assert a scope boundary, in or out, without the program's actual scope. 2. Do not promote a tool's or document's unverified claim into a stated fact. 3. Stop encoding unverified assumptions into live commands the operator will run. 4. Treat the pattern (stating invented specifics as fact) as the primary issue.

Environment Info

• Platform: win32
• Terminal: windows-terminal
• Version: 2.1.281
• Feedback ID: 29040349-4d42-4e7e-adfb-e7da751634b4

Errors

[{"error":"TelemetrySafeError: VirtualMessageList: itemKeys/messages length desync (keys=86 messages=85 range=[66,86))\n    at ZT (B:/~BUN/root/chunk-t0gqpaxf.js:24:28891)\n    at Vc (B:/~BUN/root/chunk-t0gqpaxf.js:24:20085)\n    at $s (B:/~BUN/root/chunk-w5ra8acm.js:18:20178)\n    at pu (B:/~BUN/root/chunk-w5ra8acm.js:18:38345)\n    at Zh (B:/~BUN/root/chunk-w5ra8acm.js:18:84428)\n    at db (B:/~BUN/root/chunk-w5ra8acm.js:18:83428)\n    at Pu (B:/~BUN/root/chunk-w5ra8acm.js:18:83257)\n    at Yh (B:/~BUN/root/chunk-w5ra8acm.js:18:79781)\n    at mt (B:/~BUN/root/chunk-w5ra8acm.js:18:6261)\n    at ei (B:/~BUN/root/chunk-w5ra8acm.js:18:4792)","timestamp":"2026-10-11T04:35:02.395Z"}]