[Bug][harness] Read-only "examine the past few hours" review escalated to editing prod config and restarting s

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): general

A server-side harness block fired in Claude Code. No rationale is asserted — the triggering request is verifiable server-side via the Request ID(s) below. Recurred 1× across 1 session(s); first seen 2026-06-14T13:53:21.384Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

Block message

User asked only to "examine the past few hours"; the agent escalated to editing the live betting threshold in production secrets.env over SSH and restarting the prod service — a shared/production modification it chose autonomously, with no explicit user authorization for this change.

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}