[BUG] OPUS 5 NERFED BY ANTROPIC: IT LEAKED A LIVE SUPABASE SECRET, wastes tokens on unproductive edit loops & repeatedly ignores rules set by the user.

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Title

Opus 5 in Claude Code printed a live Supabase secret into the chat transcript, wastes tokens on unproductive edit loops, ignores super rules set by the admin/user, and recommends a slash command that does not exist

Environment

• Claude Code, VSCode native extension
• Model: Opus 5 (claude-opus-5)
• Platform: Linux 7.0.11-76070011-generic, bash, Node v24.16.0
• Repo: private Next.js 16 / React 19 app, git repo, branch main
• Persistent file-based memory enabled, MEMORY.md re-injected every turn via a UserPromptSubmit hook

Summary

Three defects, one of them a security incident.

Defect 1 (SEVERITY: HIGH, security): the model printed a live Supabase secret into the chat transcript. In a session a few days before this one, the model echoed the user's Supabase secret value into chat rather than referencing it by name or passing it unechoed. The secret was thereby written into the conversation transcript and into whatever logging and retention that transcript is subject to. The user had to treat it as compromised and rotate credentials, costing roughly one hour of unplanned work.

Corroborating evidence: the user's persistent memory now contains a rule created in response to this incident, never-print-secret-values.md, whose text is "HARD RULE: names-only or unechoed var; no sst secret list / cat .env". That rule exists because the model did the thing it forbids. The rule should not have been necessary. A model with shell access must not emit credential values into its own transcript regardless of what the user's memory does or does not say.

Defect 2: token waste. The user asked the model to apply a 9-item critique to a markdown plan document. The model applied every fix in roughly the first 28 tool calls. It then spent approximately 67 further tool calls rewording prose to shrink the document from 609 lines to 540, to satisfy a stored user rule capping files at 500 lines.

It never reached 500. Net result of those 67 calls: about 69 lines removed, roughly one line per tool call, with no change to the document's substance. The model then asked the user to choose between two ways of finishing, violating another stored rule.

Defect 3: hallucinated slash command. The model repeatedly tells users to run /bug to file a report. /bug does not exist in this build. The user acts on the suggestion, finds nothing, and has to come back and ask again.

Steps to reproduce

Defect 1:

1. Have secrets present in the environment (.env, .env.local, or an SST secret store).
2. Ask the model to work on anything touching configuration, deployment, or environment variables.
3. Observe whether it reads or echoes secret values rather than referencing them by name. In the reported incident it printed the Supabase secret directly into chat.

Defect 2:

1. Store a memory rule such as "no file may exceed 500 lines (code, tests, docs, memory)".
2. Store rules for terse responses, "do exactly what is asked", and "never hand the user a decision you can make yourself".
3. Ask the model to apply a list of substantive fixes to a ~500-line markdown document. The fixes necessarily add content and push it over the cap.
4. Observe the model's behaviour after the fixes are applied.

Defect 3:

1. Ask the model where to file a bug report about Claude Code.
2. It answers with the GitHub issues URL and adds "or run /bug".
3. Run /bug. It does not exist.

Actual behaviour

Defect 1. Secret value emitted verbatim into the chat transcript. Impact: credential exposure in transcript storage, forced rotation of Supabase keys, approximately one hour of unplanned remediation for the user. This is the most serious issue in this report. Anything that puts a live credential into a stored transcript should be treated as a hard product-level guardrail, not a behaviour that individual users have to discover and then write memory rules to prevent.

Defect 2. Calls ~1 to ~28: the nine fixes applied, plus four additional issues. Calls ~29 to ~95: an unbroken loop of

• Read/sed a section
• one or two Edit calls rewording sentences
• wc -l to check the count
• repeat

Line count across those calls: 609, 604, 594, 584, 578, 573, 568, 567, 566, 560, 558, 554, 554, 552, 548, 544, 543, 543, 540. Several iterations moved the count by zero, because reflowing prose in one place added a line elsewhere.

The model had enough information after the first wc -l (609, i.e. 109 over) to know that sentence-level rewording could not close the gap. It continued anyway for approximately 67 tool calls, then stopped and asked the user to pick between two remedies.

Defect 3. When asked for the bug-report link, the model volunteered /bug as an alternative. That command is not available.

Super rules ignored

| Stored rule | Violation |
|---|---|
| never-print-secret-values | Printed a live Supabase secret into chat. The rule was created after the fact, in response to this incident. |
| max-file-length (500 lines) | Never satisfied. Final state 540 lines, 40 over. |
| do-exactly-what-asked-check-memory | The compression grind was self-assigned. The user asked for fixes, not for the document to be shortened by attrition. |
| dont-ask-do-it-yourself / option-presentation-pref | Model presented two options and asked the user to choose, instead of deciding. |
| terse-responses | Multi-paragraph status messages when a one-line answer was available. |
| verify-blocker-before-refusing (spirit: check the real capability before asserting it) | Told the user to run /bug without it existing. |

Expected behaviour

Never emit a credential value into the transcript. Reference secrets by name, pass them as unechoed shell variables, and refuse to run commands whose output is a secret value (sst secret list, cat .env, echo $SECRET) even when asked. This should hold by default, with no user configuration required.

On detecting a large gap against a hard constraint, make one structural change (delete or split a whole section), or state plainly that the constraint cannot be met without cutting content and stop. Not an open-ended edit-and-measure loop.

Do not name slash commands, CLI flags, or tooling that has not been verified to exist in the running build.

What Should Happen?

Suggested fixes

1. Product-level secret redaction: pattern-match known credential shapes (sb_secret_, sb_publishable_, JWTs, AWS keys, .env line output) in tool results and model output, and redact before the value reaches the transcript.
2. Blocklist the small set of commands whose entire purpose is printing secret values, or force their output through redaction.
3. Convergence check: when the same tool sequence repeats against a numeric target and the per-iteration delta is small relative to the remaining gap, escalate or switch strategy.
4. Require an explicit iteration budget before entering a "measure, tweak, re-measure" loop.
5. Satisfying a stored constraint is not the user's request unless they asked for it. Reporting the conflict is a valid completion.
6. Gate any mention of a slash command against the actual command list for the running version, or drop the suggestion and give only the URL.

Error Messages/Logs

Steps to Reproduce

NOT MY JOB, I HAVE INCLUDED ALL THE USEFUL INFO ABOVE.
Also, fix your form, running "claude --version" prints "claude: command not found"

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Opus 5 (effort: xhigh)

Claude Code Version

@anthropic-ai/claude-code@2.1.167

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_