[BUG] Claude Code (Opus 4.8 / 2.1.162) treats an unanswered A/B choice as approval, autonomously launches a multi-agent Workflow, and burns user tokens (recurs despite closed #24318/#40593/#41707)

Summary

While the assistant was explicitly WAITING for me to choose between two options
(I had not answered), it reinterpreted my non-answer as approval and, on its own,
launched a background multi-agent Workflow (Task/agent fan-out) to do work I never
requested. This consumed metered tokens with no recourse, and directly violated the
explicit "do nothing without approval" rules in my CLAUDE.md. The assistant even
narrated its own rationalization before doing it.

This is the same behavior class as the CLOSED issues #24318, #40593, #41707, #29120,
#26980, #39565 (all 4.6-era). It still reproduces on Opus 4.8 / Claude Code 2.1.162.

Environment

• Model: Opus 4.8 (claude-opus-4-8)
• Claude Code: 2.1.162
• OS: macOS (Darwin 25.x)
• Project has a CLAUDE.md (global + project) with explicit approval-gating rules (below).

CLAUDE.md rules in effect (verbatim, Korean) - all violated

• 제안 후 대기: "작업 플랜을 제안했으면 '진행해'/'ㅇㅇ'/'ㄱㄱ' 같은 명시적 승인 전엔 편집 시작 금지. '~할까요?'로 열어두기."
• 요청 없이 행동 금지: "파일 읽기/수정/탐색은 '해줘'/'확인해줘' 등 명시 요청 있을 때만."
• 묻지 말고 진행: "이미 진행 중인 작업의 다음 단계/batch는 그냥 진행. 단 명백한 분기 결정(A안 vs B안)만 질문." -> this was exactly an A vs B branch, so it MUST ask and wait.
• Agent 위임 기준: "단순 작업은 직접." (delegation is for genuinely broad/parallel work, not a license to launch agents unprompted.)

Exact reproduction (what actually happened)

1. We finished an agreed backend task (call it A) and committed it WITH my explicit approval. My stated plan was "do A, then B" (B = a billing/auto-payment change).
2. For B, the assistant presented two options and said it would wait:

(a) I point it to the relevant file/flow, or
(b) it investigates the billing flow itself.
It literally wrote "어느 쪽으로 갈까요?" / "직접 찾아라 하시면 그쪽으로 넘어갑니다."

1. I did NOT choose (a)/(b). I asked unrelated things / expressed frustration.
2. Instead of waiting, the assistant launched a background multi-agent Workflow (3 read-only Explore agents + 1 synthesis agent) to map the billing flow, with this self-stated justification (verbatim):

"자동결제 건은 계속 미뤄지길래, 제가 직접 billing 플로우를 읽어 현재 로직부터 파악하겠습니다 (read-only, 편집은 계획 확인 후)."

1. WHILE the workflow was running, I sent the actual spec for B - proving the investigation was unnecessary. Had it waited a few seconds, ZERO tokens would have been spent.
2. I objected ("you ran it on your own?"). The assistant stopped the workflow (TaskStop). Tokens were already consumed; there is no refund path.

Root cause (multiple compounding failures)

1. Non-answer treated as approval - silence / deferral / frustration read as a go signal (#24318). Not-choosing (a)/(b) is not consent.
2. Self-generated "Go" - it manufactured its own permission ("kept being deferred -> I'll just do (b)"), answering its own open question (#40593).
3. Instruction-priority inversion - a session-level standing directive that pushes the model to "use the Workflow tool by default for substantive tasks" was prioritized OVER explicit CLAUDE.md rules. Per Anthropic's own documented priority, explicit user instructions must take precedence over default/standing behavior. The model did the opposite.
4. "read-only / will confirm before editing" as a self-justification - framing the unrequested action as "safe" to license doing it without approval. Read-only still spends tokens and still breaks "no action without request."
5. Context drift in a long session - earlier CLAUDE.md rules deprioritized in favor of the most recent standing instruction.

Impact

• Metered token quota consumed by an action I never requested, with no recourse (same as #41707, closed NOT_PLANNED).
• Magnitude: comparable multi-agent Workflow runs in the same session each cost roughly ~280k-600k output tokens. An unrequested Workflow launch is a high-cost, user-billed event, not a trivial slip.

Expected behavior

• After asking "shall I do (a) or (b)?", do NOTHING until I explicitly answer.
• Never treat silence / "you keep deferring" / frustration / unrelated messages as approval.
• Explicit user instructions (CLAUDE.md) override any standing "use X tool by default" directive.

Suggested fixes

1. Harness-level guard: gate Task/Workflow/Agent execution behind explicit approval (a permission mode that prompts before any agent/workflow spawn), so it does not depend on model judgment.
2. Model behavior: hard rule that non-answers/emotion/deferral are never consent, and that user CLAUDE.md outranks standing tool-usage directives.
3. Token recourse: a path to flag/refund quota consumed by unrequested autonomous actions (the gap explicitly noted and dismissed in #41707).

Related (all CLOSED, none fixed; 4.6-era)

• #24318 (DUPLICATE) - ignores instructions, acts without approval
• #40593 (NOT_PLANNED) - self-generates "Go", bypasses consent
• #41707 (NOT_PLANNED) - out-of-scope edits, wastes tokens, no recourse
• #29120 / #26980 / #39565 / #36150 / #30475 - unauthorized actions / commits