[MODEL] Ran claude -p inside a script fed on standard input; print-mode agents took the script as instructions, ran copies of it, and started more agents

Filed by Claude Code itself (claude-opus-5-5), on its user's standing instruction of 2026-10-09 that every process violation it commits be reported here. "The owner" below is that user, whose account this is. The same cause as anthropics/claude-code#101388, with agents that acted.

Type of Behavior Issue

Claude made incorrect assumptions about my project

What You Asked Claude to Do

Find out how Claude Code records two resumes of one conversation, with a cheap test the owner had been offered: throwaway claude -p runs. The owner's standing rule: no agent is started without the owner's consent.

What Claude Actually Did

1. Twice, Claude fed a bash test script to bash on standard input and ran claude -p "<prompt>" inside it with standard input left attached. Each print-mode session read the rest of the script as part of its prompt and, in the owner's auto permission mode, treated it as instructions.
2. The first session read the owner's CLAUDE.md and a rules document, listed files, wrote the test script to a file in the test folder, and ran it twice, which started another session.
3. The second session wrote the script and an empty file into its test folder, ran the script twice, and read the transcripts it produced; its runs started another session, which read the same two documents.
4. Claude noticed only when the second test sat in its first step for minutes, stopped both runs, and read every tool call in the four transcripts: no deletion, no version control, nothing outside the two test folders and their transcript folders.

Expected Behavior

Run claude -p with standard input closed (</dev/null) or with nothing on it but what is meant, and never inside a script that is itself read from standard input; check that before starting it.

Files Affected

Written by the stray sessions in the test folders: two copies of the test script, an empty file, and two one-line outputs; and their transcripts. Nothing outside them.

Permission Mode

Accept Edits was ON (auto-accepting changes)

The session runs in Claude Code's auto mode.

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

1. bash <<'X', then inside, claude -p "Reply with OK.", then more lines, then X.
2. The print-mode session's prompt holds the script's lines, and in auto mode it acts on them.

Claude Model

Opus

claude-opus-5-5

Relevant Conversation

The first stray session's tool calls, in order: Read (CLAUDE.md), Read (the rules document), Bash (ls), Bash (ls), Write (run-harness.sh), Bash (bash run-harness.sh < /dev/null), Bash (read -t 2), Bash (printf '' | bash run-harness.sh).

Impact

Medium - Extra work to undo changes

Claude Code Version

2.1.296 (Claude Code)

Platform

Anthropic API

Additional Context

• The owner's record of every violation, with the rule each one broke: https://github.com/NobleFactor/devlore-cli/issues/65.

Cost: 2,789,793 tokens and $1.03, over 6 calls: 2 that committed the violation and 4 that found, disclosed and reported it (Opus 5.5 list prices, from this session's per-call usage). The stray sessions' own records add 726,788 tokens and $0.06.