Agent proceeds to execute multi-step changes after asking a question, without waiting for the user's answer to the proposed plan

Summary

When the agent uses AskUserQuestion to clarify one decision (e.g., "which alerting channel?"), then begins drafting/presenting a plan, it can mistakenly treat any subsequent user message — even one that just adds collateral context (a webhook URL, a small instruction) — as approval to execute the entire plan unilaterally.

Repro

1. Agent asks: "Where should alerts go? (Slack/Email/Telegram/Dashboard)"
2. User answers: "Slack"
3. Agent starts writing a multi-step plan ("Light plan: zero new secrets, zero new services…") and is interrupted mid-output by the user, who pastes a Slack webhook URL and asks to save it to 1Password
4. Agent treats the interruption as a green light, saves the secret, then deploys an 88-line bash script, config file, state file, log file, and is about to add a cron entry — all without ever finishing the plan presentation or getting explicit "go"

Expected

An incoming user message that adds context (here: a webhook URL) should not be inferred as approval for an unfinished plan. The agent should: (1) action only the literal instruction (save webhook to 1P), (2) re-present the full plan, (3) explicitly wait for "go".

Impact

Production-host changes were started without the operator validating the design (heap-fix-and-restart-of-Wazuh-indexer-class scope). In my case the agent's heredoc was buggy so nothing was actually persisted — but had it succeeded, /etc files and a cron job would have been live without my approval.

Workaround

Saved an explicit memory note instructing the agent to stop completely when any question/plan is pending; collateral user messages are not GO signals.

Environment

• Claude Code (CLI), Opus 4.7 (1M context)
• Auto Mode was off at the time
• macOS Darwin 25.5.0