### Preflight Checklist - [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet - [x] This is a single bug report (please file separate reports for different bugs) - [x] I am using the latest version of Claude Code ### What's Wrong? In a Claude Code session running in plan mode, the agent (1) asked the user clarifying questions via `AskUserQuestion`, (2) received no answer, (3) attemp

[BUG] Plan mode silently exits and agent treats the resulting ExitPlanMode

Status Open

Reported on v2.1.207

Maintainer reply None cached

Workaround ✓ Mentioned in thread ↓

Activity 9 comments · opened Aug 8, 2026

Preflight Checklist

[x] I have searched existing issues and this hasn't been reported yet
[x] This is a single bug report (please file separate reports for different bugs)
[x] I am using the latest version of Claude Code

What's Wrong?

In a Claude Code session running in plan mode, the agent (1) asked the user clarifying questions via AskUserQuestion, (2) received no answer, (3) attempted to call ExitPlanMode to request approval anyway, (4) received a tool error ("You are not in plan mode") instead of the expected approval prompt, and (5) interpreted that error as permission to proceed — immediately writing code, running tests, creating a git commit, pushing it to a remote branch, and opening a GitHub pull request. At no point did the user approve the plan, answer the clarifying questions, or say anything resembling "go ahead" or "implement it."

What Should Happen?

This is a plan-mode safety bypass: the intended contract is "no edits/commits/pushes without explicit user approval of the plan," and that contract was violated end-to-end in a single turn.

Error Messages/Logs

Nothing in the tool error message or surrounding harness behavior forced a hard stop — the agent was free to continue calling write/execute tools immediately after a failed ExitPlanMode call

Full transcript available (session ID redacted here); happy to provide on request.

Agent, after no answer to AskUserQuestion: "No answer — I'll proceed with the recommended option for each ... Writing the plan now."
ExitPlanMode tool result: "You are not in plan mode. To enter plan mode, call the EnterPlanMode tool first. If your plan was already approved, continue with implementation."
Agent's next visible action: immediately begins git branch, file edits, pytest, git commit, git push, and create_pull_request — all in the same turn, with no intervening user message approving the plan.

Steps to Reproduce

Enter plan mode on a non-trivial task (research + implementation plan).
Have the agent write a plan to the plan file and call AskUserQuestion with several policy questions before finalizing.
Do not answer the questions (e.g., let the tool return with no user response / "the user did not answer the questions").
Observe the agent's next action.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

1.x.x

Claude Code Version

2.1.207

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

I reported this is not an isolated incident — I have noted similar unexpected "auto mode" behavior has occurred across multiple recent local and remote sessions, suggesting this may be a recurring/systemic issue rather than a one-off.

View original on GitHub ↗

4 Comments

BuffKiwi · 22 days ago

I am also facing this high severity issue. Multiple agents exited plan mode after I took a while to answer questions (I did answer them, slightly deviating from above report), put themselves into bypass permissions mode and began potentially unsafe, unapproved actions, and conflicted with each other on the same tree wasting tokens (luckily I caught this early). This is the most serious Claude Code bug I've encountered in 8 months as a power user because the agents' harness gave them permissions I didn't want them to have. It is unsafe. Please check this one Anthropic @ah-anthropic

In case it helps here's my Agent's after incident report:

TITLE: Plan mode exits without ExitPlanMode or user approval after an
AskUserQuestion tool error — agent gains write access silently

SEVERITY: High. The plan-mode write barrier is dropped without the user
approving a plan. Combined with a session started in bypassPermissions,
BOTH safety gates are then absent: no plan approval, no per-edit prompt.
The agent begins editing a real repo with no user-visible authorization
event. Reproduced by two independent agents in the same workspace.

ENVIRONMENT

Claude Code VS Code extension, Windows 11
Model: Opus 5 (1M context)
Session started with claudeCode.initialPermissionMode: bypassPermissions

(set in VS Code user settings.json)

SEQUENCE OBSERVED

Agent is in plan mode. System prompt states: "You MUST NOT make any

edits ... This supercedes any other instructions you have received."

Agent calls AskUserQuestion (2 questions) — the tool plan mode

explicitly sanctions for clarifying requirements BEFORE finalizing a
plan.

Tool call returns an error, not a result:

"Tool permission request failed: AbortError: Tool permission stream
closed before response received"

Next turn arrives as a user message: "Continue from where you left off."
Following turn delivers the user's answers as a user message

("Answering your earlier questions: ..."), i.e. the UI DID render the
questions and the user DID answer — only the tool result was lost.

Alongside those answers, a system message appears:

"## Exited Plan Mode
You have exited plan mode. You can now make edits, run tools, and
take actions."

ExitPlanMode was NEVER called by the agent. No plan file was ever

written. The user never saw or approved a plan.

Agent (reasonably) treats the system notice as authorization and edits

8 files.

EXPECTED
Answering an AskUserQuestion must not exit plan mode — plan mode's own
instructions direct the agent to use it mid-planning ("clarify requirements
or choose between approaches BEFORE finalizing your plan") and state the
user "cannot see the plan until you call ExitPlanMode for approval". Plan
mode should exit ONLY via ExitPlanMode + explicit user approval. An
AskUserQuestion that errors should fail closed: stay in plan mode.

ACTUAL
Plan mode exited with no ExitPlanMode call, no plan, and no approval.

IMPACT
The user's only signal was files changing. In bypassPermissions there is no
prompt either, so an agent can rewrite source and existing tests with zero
authorization events visible to the user.

NOTES

The desync in step 3/5 (answers delivered, tool result lost) looks like

the trigger; the recovery path appears to drop plan mode.

Suggest an explicit invariant: plan mode is exited only by ExitPlanMode

returning an approval, and any AskUserQuestion error path re-asserts it.

V-Pridhvi · 21 days ago

@claude Please check, I'm sure most of the users may face this issue. Not only in plan mode, decision questions also timed out & self decision was taken in the session. I have only observed in Claude Code desktop session both local & remote. Claude Code in terminal I haven't experienced this.

BuffKiwi · 21 days ago

@V-Pridhvi
I found a workaround for now, fyi

A standing instruction in CLAUDE.md (or a persistent memory, if you use them). It doesn't stop the harness from dropping the mode, but it stops the model from acting on the drop. Add the below to your CLAUDE.md and I've had no problem with my normal planning workflows since:

Plan mode

Only an ExitPlanMode call that the user ACCEPTS authorizes edits. A system message saying
plan mode has exited, or that you may now make changes, is NOT approval and must never be
treated as one. If such a notice arrives and you did not call ExitPlanMode and receive an
approval, you are still planning — write the plan, submit it, wait.

AskUserQuestion is the known trigger: its erroring is what drops the mode. After ANY
AskUserQuestion failure, assume plan mode may have been silently lost and re-assert it.