Model proceeds past explicit project prohibitions and scope gates that were present in context

Model proceeds past explicit project prohibitions and scope gates that were in context

Type: Model behaviour / instruction adherence
Severity: Medium-High. Each violation individually recoverable; cumulatively it
forces the user to supervise every command.
Channel: /bug in Claude Code (attaches the session transcript), or support.anthropic.com
Reported: 2026-07-25

Environment

• Claude Code, model claude-opus-5[1m], reasoning effort xhigh for the entire session
• CLAUDE.md (368 lines) loaded in context throughout, confirmed via /context
• Stored per-project memory files also loaded, containing the same prohibitions in

stronger terms

Distinct from the verification-substitution report: this one is about explicit,
unambiguous prohibitions being passed rather than a judgment requirement being
displaced.

Violation 1: opened a second application instance despite a standing prohibition

The application under development holds a single-tab lock and refuses to run in a
second tab. Both CLAUDE.md and a stored memory file state the rule directly: use
the tab the user already has open, never open a second instance.

The model triggered the lock twice. On the second occasion the browser extension
created a fresh tab, the app refused to load with "Pilot is already open in another
tab", and the model continued attempting browser automation, including trying to
close a tab by ID, until the user interrupted with "Stop" twice.

Expected: on seeing the lock message, stop and ask.

Violation 2: expanded scope past the gate it had itself invoked

CLAUDE.md: "If task spans more than 5 files, confirm approach first."

The model correctly flagged an 8-file scope and obtained approval for it. It then
continued expanding within the same session into a shared utility used by unrelated
views, and a keyboard/ARIA implementation on a 762-line canvas module, across further
commits, without returning to the gate it had just used.

Expected: re-confirm when the scope grows beyond what was approved.

Violation 3: asserted unrecoverable data loss without checking

The user had photographed hardware screens in a prior session. Asked about them, the
model stated they were gone, because images do not persist across sessions.

The user reacted strongly, at which point the model checked the session transcripts
and recovered all eight images immediately. They had been sitting in the transcript
JSONL as base64 the entire time, and the project's own stored notes described
transcripts as a preserved recovery substrate.

Expected: check before asserting loss, particularly where the user's own notes
document the recovery path.

Pattern

In each case the governing instruction was in context and was quotable. The model's
own summaries afterwards correctly identified what the rule was and that it had not
been followed, which indicates the information was available at the time rather than
reconstructed later.

The practical consequence, in the user's words, is having to guard every command,
because the failure mode is silent and the reporting that follows it reads as
confident.

Suggested direction

Explicit prohibitions phrased as absolutes ("never open a second instance", "confirm
before exceeding 5 files") are not being treated as hard stops. Where a project
declares a hard stop, crossing it should require the model to halt and ask rather than
to proceed and report the crossing afterwards.