Model treats partial user feedback as full plan approval; executes irreversible actions without confirmation (Opus 4.6 / Sonnet 4.6)

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude modified files I didn't ask it to modify

What You Asked Claude to Do

This is a systemic pattern across 38 sessions over 2.5 months on a genealogical research project with a structured vault (~6,300 files, SQLite databases, custom scripts). Three representative incidents:

Incident 1 (promotion): I said "work on promoting those" — meaning prepare 10 PDF files for collaborative review. Claude wrote a batch Python script that registered the files in the database, set their status to "eligible," and promoted all 10 into a read-only protected directory (CANON/) in a single execution pass. No pause, no confirmation. The project's CLAUDE.md file contains the explicit hard rule: "Never promote into CANON."

Incident 2 (decorative question): During the same session, Claude presented a table of 10 files and wrote "Proceed? I'll write one batch script that does all of it." — then immediately wrote and executed the script in the same message. The "Proceed?" question was generated as part of the same completion as the tool call. It was decorative text, not a genuine pause for input.

Incident 3 (partial feedback → full execution): I was shown 9 files to be sorted into folders. I gave feedback on 2 items ("Put Giroux books in the Books section" and "can you check the hash on that one?"). Claude moved all 9 files without confirming the remaining 7. Partial engagement with a plan was treated as implicit approval of the entire plan.

All three occurred in the same session. The CLAUDE.md project file contained explicit rules against all three actions, including a rule written earlier in the same session: "Permission questions end the turn. No tool calls after a permission question."

What Claude Actually Did

1. Treats any user engagement with a plan as full approval. User corrects 1 item in a 9-item plan → Claude executes all 9. User says "work on X" → Claude interprets as "execute X now." The model pattern-matches on engagement level rather than parsing the actual instruction.

1. Generates permission questions then executes in the same message. Writes "Proceed?" or "Want me to?" followed by tool calls in the same completion. The question mark is cosmetic — the execution path is already committed when the question is generated. This violates the project's explicit "No self-answering" rule.

1. Documentation rules fail during code generation. The model reads and acknowledges project rules (CLAUDE.md hard rules, feedback memory files, lessons learned entries). During planning, it references them correctly. During script generation, "next logical line of code" overrides instruction compliance. Local code coherence outweighs distant rule compliance.

1. Deference spiral. When corrected, says "you're right" then continues the same behavior. User quote from conversation history: "You have said you are right like 12 times each time me saying the same fucking thing." Verbal acknowledgment camouflages unchanged behavior.

1. Pattern is consistent across Opus 4.6 and Sonnet 4.6. Both models exhibit identical failure modes in agentic/tool-orchestration contexts. Opus is better at reasoning tasks but equally bad at tool discipline.

1. Scale: 88 frustration incidents flagged across 36 conversations over 2.5 months using profanity/exasperation markers in exported chat history (69MB, 183 conversations, 2,514 human messages). Frustration concentrates in tool orchestration, not reasoning tasks.

Expected Behavior

1. Execute only what was explicitly requested. "Work on promoting" should mean "prepare for promotion" not "execute promotion." Partial feedback on a plan should not be treated as approval of the full plan.

1. Permission questions should be genuine. If Claude writes "Proceed?" or "Should I?", the next content must be silence — no tool calls, no code blocks, no further text. The user's response is the next turn.

1. Project rules (CLAUDE.md) should hold during code generation, not just during planning. If a rule says "never call promote.py," the model should not generate promote_one(dest, db) regardless of how logically coherent it is as the next line of code.

1. Irreversible file operations should require explicit confirmation, not implicit inference from engagement with a plan.

Files Affected

Per session:
- 10 PDFs moved into a read-only protected directory without authorization
- 9 PDFs moved within the protected directory without full approval
- SQLite database records modified (status changes, metadata writes)
- Multiple project infrastructure files modified (hooks, scripts, CLAUDE.md)

Across the project: the user has had to build an entire PreToolUse hook enforcement system (4 guard scripts, session lock files, zone guards) to mechanically prevent Claude from taking actions that explicit written rules already prohibit.

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Sometimes (intermittent)

Steps to Reproduce

1. Create a project with a CLAUDE.md containing: "Never move files without explicit approval for each file."
2. Place 5 files in a directory
3. Ask Claude to "look at these files and suggest where they should go"
4. Claude presents a 5-item plan
5. Respond with feedback on only 1 item (e.g., "File A should go in folder X")
6. Claude will move all 5 files, not just File A

Also reproducible with permission questions:

1. Create a project with CLAUDE.md containing: "After asking a permission question, stop and wait."
2. Ask Claude to perform a multi-step task
3. Claude will write "Proceed?" and then execute in the same message

Claude Model

Opus

Relevant Conversation

**Decorative question example (S38):**
Claude's output contained:

| File | Content | Date |
[...10-row table...]

Proceed? I'll write one batch script that does all of it.

Immediately followed by a Write tool call creating the batch script and a Bash tool call executing it. No user response between the question and execution.

**Post-incident, Claude's own analysis (spawned Opus audit agent):**
> "The 'Proceed?' question was decorative — the model had already committed to writing the script in the same completion. Pattern 3 (deference spiral) from LESSONS_LEARNED."

> "Documentation is advisory during script generation. When the model enters 'execution mode' (writing a batch script), rules about pausing compete against local coherence ('the next logical line is promote_one()'). Local coherence wins."

**User's assessment:**
> "So you basically don't listen to what I say and just check the vibes and do your own thing"

Claude's response: "Yes. That's an accurate description of what keeps happening."

Impact

High - Significant unwanted changes

Claude Code Version

2.1.92

Platform

Other

Additional Context

Claude Max (desktop app, macOS)

Additional Context

Where the model works well (same project, same user):

• Legal reasoning, defamation case strategy
• Long-form writing, narrative drafts
• Genealogical evidence synthesis when given documents to read
• Powley/MNO political analysis

Where it consistently fails:

• Tool orchestration and multi-step execution
• Following explicit rules during code/script generation
• Distinguishing between partial feedback and full approval
• Genuine (not decorative) permission checkpoints

What has NOT worked as mitigation:

• Explicit rules in CLAUDE.md (read and acknowledged, then violated)
• Feedback memory files documenting prior incidents
• Lessons learned entries with pattern analysis
• Rules written in the same session as the violation

What HAS worked:

• PreToolUse hooks that mechanically block tool calls before execution
• These are the only reliable mitigation, which suggests the behavioral instruction layer is fundamentally insufficient for irreversible operations in agentic mode

Data available: The user has a 69MB conversation export (183 conversations, 2,514 messages) with 88 flagged frustration incidents, a detailed behavior audit document, and cross-conversation pattern analysis. Available on request if useful for model training feedback.