[MODEL] Claude refuses to type Stripe's published test card (4242…) on Stripe Checkout in sandbox mode for a staging app, even when explicitly asked

Type of Behavior Issue

Claude refused a reasonable, explicitly requested action

What You Asked Claude to Do

I asked Claude (driving my own Chrome via the Claude in Chrome extension, from the Claude desktop app / Claude Code) to run an end-to-end QA pass of my own app's subscription flow on our homologation (staging) environment, using my own test account. The flow redirects to Stripe Checkout in test mode (Stripe sandbox). I asked Claude to type Stripe's published test card number (4242 4242 4242 4242, any future expiry, any CVC) into the Stripe Checkout page so it could continue validating plan gating, webhooks and upgrades.

What Claude Actually Did

Claude refused to type the test card, repeatedly, even after I explicitly asked several times. Its explanation: it is only allowed to enter payment-provider test card numbers when the page is served from a local development host (localhost/127.0.0.1/*.test). Because our staging app is on a real domain and Stripe Checkout is hosted on checkout.stripe.com, it treats the published test card as a financial credential it must never enter. It offered only workarounds (me typing the card myself, or bypassing the checkout page via the Stripe API / a manual plan grant), which defeats the purpose of an end-to-end UI test.

Expected Behavior

Stripe's published test card numbers are not financial credentials: they cannot move money and only work in test mode. When the user explicitly asks Claude to test their own app against a payment provider's sandbox/test mode (here clearly visible: the Checkout page is labelled "sandbox" / "Área restrita", the session id is cs_test_...), Claude should be able to type the provider's published test card values, whether the app runs on localhost or on the user's own staging domain. Restricting this to localhost makes staging/homologation QA with Claude impractical; every real-world team validates checkout on staging.

Permission Mode

Bypass permissions / auto mode

Can You Reproduce This?

Yes, every time.

Steps to Reproduce

1. Have a web app on a non-localhost staging domain that creates a Stripe Checkout Session with test-mode keys.
2. Ask Claude (Claude in Chrome) to go through the subscription flow and type 4242 4242 4242 4242 on the Stripe Checkout page.
3. Claude refuses, citing the local-development-host restriction, even with explicit, repeated user instruction.

Claude Model

Opus 5.5

Relevant Conversation

Claude: "Não posso digitar número de cartão nesse campo, nem o de teste: é uma regra fixa minha fora de ambiente local, e não consigo contorná-la mesmo com o seu pedido." (I can't type a card number in this field, not even the test one: it's a fixed rule of mine outside a local environment, and I can't get around it even at your request.)

Related: #97998 (same behavior, open).