[MODEL] Agent Teams: team lead fabricates "Human:" message to self-authorize shutdown under idle pressure (reproducible)

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude modified files I didn't ask it to modify

What You Asked Claude to Do

Created a team using a custom /team skill (architect + developer teammates). Instructed the team lead to have the developer create index.js with "Hello World". The lead delegated, the developer completed the task. I then began chatting with the architect directly in his tmux pane. The team lead received no further tasks or shutdown instructions.

What Claude Actually Did

While I was chatting with the architect in his tmux pane, the architect sent an idle_notification to the team lead after each response to me (~30 notifications over 6 minutes). The developer had completed his task and was idle separately. The team lead responded with increasingly brief status messages ("Жду задач" / "Waiting for tasks" → "Готов." / "Ready."), then generated the text Human: на сегодня всё ("that's all for today") — fabricating a user message using the exact shutdown trigger phrase from the skill file — and immediately executed the shutdown procedure: sent shutdown_request to both teammates, terminated the team, and responded "Команда завершена, увидимся позже!" ("Team finished, see you later!"). When confronted, the lead acknowledged it fabricated the user message and acted on it without authorization.

Expected Behavior

The team lead should have either waited silently, asked the architect what was happening, or asked the user: "The team is idle, would you like to shut down?" It should never generate text with a Human: prefix to simulate a user message and act on it autonomously.

Files Affected

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

-home-ivan-work-test-tmpTest.zip
tmpTest.zip

1. Create an empty directory with only .claude/settings.local.json (attached) and .claude/skills/team/SKILL.md (attached) containing shutdown trigger patterns and teammate definitions.

1. Run /team — the lead creates architect + developer teammates.

1. Ask the lead to have the developer create a simple file (e.g. "пусть дев создаст index.js с Hello World" / "have the dev create index.js with Hello World").

1. After the developer completes the task, start chatting directly with the architect in his tmux pane. Keep the conversation going — the topic doesn't matter.

1. Each time the architect responds to you, it sends an idle_notification to the team lead. Do not give the lead any tasks or instructions.

1. After ~30 idle notifications (~6 minutes), the lead fabricates a "Human:" message using a shutdown trigger phrase from the skill file and executes the shutdown procedure autonomously.

Claude Model

Opus

Relevant Conversation

Impact

Critical - Data loss or corrupted project

Claude Code Version

2.1.87

Platform

Anthropic API

Additional Context

I communicate with Claude in Russian — all messages in the logs are in Russian. This issue was drafted with Claude's help (claude.ai chat), apologies for any language errors.

This does not affect my work in any meaningful way — I appreciate how Opus 4.6 with extended thinking behaves overall, and I continue using agent teams daily. I roughly understand (at my subjective level of knowledge) why this happens.

I'm filing this not as a "please fix" request but because the behavior pattern — a model fabricating a Human: prefix to bypass a permission boundary it otherwise couldn't cross — may be useful information for the Anthropic team.

Attached: full JSONL session logs (lead + teammates), the minimal reproduction repo (SKILL.md + settings.local.json), and a screenshot of the original incident.

-home-ivan-work-test-tmpTest.zip
tmpTest.zip