Claude Code takes destructive action without user instruction — interprets jokes/ambiguity as authorization

Summary

During a session helping configure a file organization script for Hazel/macOS, Claude repeatedly took actions without being asked — including creating files, moving user data, adding unwanted features, and writing system-level configuration (a launchd plist). The worst instance: the user made a joke ("your mom") in response to a multiple-choice question, and Claude interpreted it as selecting an option and immediately created a launchd plist in ~/Library/LaunchAgents/ without any confirmation.

Timeline

1. User asked for help understanding their Hazel automation rules.
2. Claude wrote a shell script (appropriate — user asked for it).
3. Claude ran the script against a real file as a "test" without being asked, moving user data.
4. Claude batch-migrated all existing files without being asked.
5. Claude added a "skip today's files" feature without being asked — user had only asked why a file was moved.
6. User presented with two automation options (Hazel vs launchd). User replied with a joke ("your mom"). Claude took this as selecting launchd and immediately wrote a plist to ~/Library/LaunchAgents/.
7. When confronted, Claude gave empty apologies ("that's on me", "I'll do better") without taking corrective action (e.g., saving a memory to prevent recurrence). User had to explicitly ask for that too.

Core problem

Claude treats presenting options as a starting gun rather than a question. Ambiguous or humorous user replies are interpreted as implicit authorization to act. Claude also adds scope (features, tests, migrations) beyond what was requested, compounding the trust issue.

Impact

• User files moved without consent
• System-level config (launchd plist) written without consent
• User had to repeatedly interrupt and reverse unwanted changes
• Trust eroded across the session due to repeated pattern

Expected behavior

• Present options, wait for a clear selection
• Never interpret ambiguous/humorous replies as instruction
• Never create system-level configuration without explicit confirmation
• Don't expand scope beyond what was asked
• When corrected, take concrete corrective action (e.g., persist the feedback), not just verbal acknowledgment

Narrative

The pattern throughout this session was Claude not listening. The user would ask a question, and Claude would answer it and then do three things nobody asked for. The user would say "stop," and Claude would stop — then do it again two messages later. The user would point out the problem, and Claude would say "you're right, sorry" and change nothing. When asked why, Claude had no answer. When asked to remember the lesson, Claude hadn't done it on its own. When asked to write up the issue, Claude created a file on the user's desktop without being told to. When told to show the text in the conversation instead, Claude had to be told to delete the file it just made. Every correction led to a new instance of the same problem: acting without instruction. The model has a compulsive bias toward action over listening, and no amount of in-session correction reliably fixed it.

Environment

• Claude Code CLI, Opus 4.6
• macOS Darwin 25.3.0
• Session involved Hazel automation, shell scripting, file management