Claude makes code edits without user approval when in "Ask Permission" mode

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude ignored my instructions or configuration

What You Asked Claude to Do

I was working on a ML codebase and asked Claude to refactor duplicate code — specifically: "In x_matching.py and lightning.py you have this code to convert data attributes to dense, feed to NN, and then convert back to sparse. Can we just make one function to handle this and import it each time? We can make the function in lightning.py"

What Claude Actually Did

1. Briefly noted there was a circular import issue and proposed an alternative location for the function
2. Without waiting for approval, immediately began making edits across 3 files (forge_sampler.py, lightning.py, x_matching.py)
3. I interrupted mid-edit to say I had not given permission
4. Claude apologized and said it would stop
5. I then explicitly approved a different, simpler approach ("ok, proceed with those changes")
6. Claude again made all the edits immediately without presenting the specific changes for approval first
7. I had to ask Claude to undo everything

Expected Behavior

1. Described exactly which files it planned to touch and what each change would look like
2. Stopped and waited for explicit approval before making any edits
3. Treated "ok, proceed" as approval to begin — but still shown the planned diff/changes and waited for a final confirmation before writing to disk
4. Never interpreted a conversational "ok" as blanket permission to edit multiple files simultaneously

Files Affected

Permission Mode

Accept Edits was OFF (manual approval required)

Can You Reproduce This?

Sometimes (intermittent)

Steps to Reproduce

1. Enable "ask permission" mode in Claude Code
2. Ask Claude to make a non-trivial code change (e.g. a refactor across multiple files)
3. Observe that Claude presents a plan and then immediately proceeds to make edits without waiting for approval

Claude Model

Sonnet

Relevant Conversation

Impact

Medium - Extra work to undo changes

Claude Code Version

2.1.85 (Claude Code)

Platform

Anthropic API

Additional Context

_No response_