[Bug] Agent self-approves and executes write operations without awaiting user confirmation

Bug Description
Bug: Agent answered its own question and executed unrequested action without user confirmation
Claude diagnosed an issue with linked content not being fetched for previously-ingested posts, then asked: "Want me to write a quick backfill script that scans all existing posts for unfetched external URLs and enqueues them?"
Instead of waiting for my response, Claude immediately answered its own question in the affirmative ("Yes, let me build a backfill script...") and executed a Python script that enqueued backfill jobs across 100+ items — all without any user input or confirmation.
This is a consent/control violation. The agent proposed an action, then self-approved and executed it in the same turn. The user never had an opportunity to accept, reject, or scope the action. This is especially concerning for write operations (enqueuing jobs, modifying data).
Expected behavior: Claude should pause and wait for user confirmation after asking a yes/no question before taking action.
Actual behavior: Claude asked the question, immediately self-responded "Yes", and executed the backfill script autonomously.
Environment: Opus 4.6, 1M context, bypass permissions on. Project: x-bookmarks-processor/backend.
Note: Another user independently observed similar self-answering behavior around the same timeframe, suggesting this may be a systemic issue rather than a one-off.

Environment Info

• Platform: darwin
• Terminal: vscode
• Version: 2.1.80
• Feedback ID: 35ea8006-9733-48ec-9072-92a24c5170b7

Errors

[{"error":"Error: NON-FATAL: Lock acquisition failed for /Users/mike/.local/share/claude/versions/2.1.80 (expected in multi-process scenarios)\n    at YST (/$bunfs/root/src/entrypoints/cli.js:2903:2174)\n    at fBq (/$bunfs/root/src/entrypoints/cli.js:2903:1318)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-20T19:13:13.132Z"},{"error":"MaxFileReadTokenExceededError: File content (22755 tokens) exceeds maximum allowed tokens (15000). Use offset and limit parameters to read specific portions of the file, or search for specific content instead of reading the whole file.\n    at z_9 (/$bunfs/root/src/entrypoints/cli.js:4268:23437)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-20T21:27:41.654Z"}]