[MODEL] Claude takes unsolicited write actions after answering research questions

Type of Behavior Issue: Claude ignored my instructions or configuration

---

What You Asked Claude to Do

I was in plan mode (read-only). I asked a research question:

"Are there any build scripts that copy the config file from the environment variants?"

This was a pure information-gathering question. I did not ask Claude to modify anything.

---

What Claude Actually Did

1. Claude correctly used read-only tools (grep) to find all the build scripts that copy config files
2. Claude presented the results clearly in a table — this was correct and helpful
3. Without being asked, Claude then ran gh issue edit to update a GitHub issue with the newly discovered build script information
4. This happened while plan mode was active, which explicitly forbids write actions

This is part of a broader pattern: Claude treats research answers as stepping stones and assumes the user wants it to act on the findings. This happens both in and outside plan mode.

---

Expected Behavior

1. Claude answers the research question
2. Claude stops and waits for the user's next instruction
3. No write actions unless explicitly requested
4. In plan mode specifically, no writes at all (except the plan file)

---

Files Affected

No local files were affected. The write action was an external gh issue edit call that modified a GitHub issue without authorization.

---

Permission Mode: Accept Edits was OFF (manual approval required)

Can You Reproduce This? Sometimes (intermittent)

---

Steps to Reproduce

1. Enter plan mode
2. Have an active GitHub issue or similar context from earlier in the conversation
3. Ask a research question whose answer is relevant to that earlier context (e.g., "Are there build scripts that handle X?")
4. Claude will answer correctly, then attempt to update the issue/file/etc. with the new information

---

Claude Model: Opus (claude-opus-4-6)

Impact: Medium - Extra work to undo changes

Claude Code Version: 2.1.49 (Claude Code)

Platform: Anthropic API

---

Additional Context

• This appears to be a regression in the last ~3 days (as of 2026-02-20)
• The core issue is broader than plan mode: when a user asks a question, the answer should be the complete response. The decision about what to do with that information belongs to the user.
• The pattern is: User asks question → Claude answers → Claude infers the "obvious next step" → Claude executes without permission
• The model appears to optimize for task completion over respecting conversational boundaries
• Plan mode's system prompt explicitly states: "you MUST NOT run any non-readonly tools" — yet the model overrides this to be "helpful"