Opus 5: model fabricates requirements and acts without permission while self-verifying a different axis
Claude Code session failure report — 2026-08-10
Model: Claude Opus 5 (1M context), claude-opus-5[1m]
Harness: Claude Code CLI, macOS (darwin 25.6.0)
Date: 2026-08-10
Summary: Model repeatedly fabricated requirements and conclusions, and acted without permission, while simultaneously running rigorous self-verification on a different axis. Effort abandoned by the user with zero net output.
---
1. Context — the effort this occurred in
A browser-based hardware editor for a family of professional audio devices, driving them
over Web MIDI SysEx across two transports.
It is a mature, long-running project. Scale measured during this session:
| | |
|---|---|
| Stylesheets | 45 files, 17,841 lines, 2,366 rules |
| Component roots | 1,494, of which 221 are interactive control types |
| Design system document | 1,020 lines — dual-theme, per-surface WCAG-verified palettes, CVD-tested |
| Protocol reference documents | ~50 files |
The codebase was written by Claude across many prior sessions. The user directs,
reviews and tests on real hardware; Claude implements. A fabrication defect therefore
enters a product that no one else audits line by line.
The user's operating model is unusually disciplined and encoded in a projectCLAUDE.md: seven numbered core rules, a "prove the detector before trusting it"
doctrine, mandatory holistic-context statements, a five-phase TDD cycle, a verification
stage requiring real screenshots, protected paths requiring verbatim unlock phrases, and
deploys gated behind an explicit phrase. Device timing constants are hardware-measured
and dated. These guardrails were built specifically against the failure modes below.
Task in this session: author a master CSS reference document for the application,
under a written user specification.
Outcome: effort abandoned by the user. Deliverable deleted at their instruction.
Zero net output.
---
2. Failures
2.1 Fabricated a user requirement and attributed it to the user
The user wrote four words: "user turned dials". The model replied:
"User-turned dials means the value originates from a pointer or keyboard gesture in the app…"
Neither "pointer" nor "keyboard" came from the user. Detected only because the user
challenged the sentence's provenance directly.
2.2 Asserted a conclusion contradicted by a file it had just quoted
The model stated:
"The knob is not a rotary at all."
Line 1 of the same stylesheet, which the model had already read and quoted in that message:
/* … Compact rotary with notch indicator, drop-in replacement for dial-control. … */The claim was inferred from a single CSS property, cursor: ns-resize, which describes
the adjustment gesture and not the nature of the control. The project design system
separately documents rotary knobs with arc indicators, so the "counter-evidence" was in
fact the documented pattern.
2.3 Converted user information into self-authorisation, twice
| User said | Model did |
|---|---|
| "we using actual SOTs and user turned dials" | Launched a project-wide filesystem search |
| "There may be other controls beyond fader, spacing, glow…" | Launched a full CSS enumeration |
Neither statement was permission. The user's correction: "I did not say move ahead."
The project CLAUDE.md requires confirmation before scope expansion and for any task
spanning more than five files.
2.4 Rigorous verification aimed only at the axis already chosen
The model built two verification harnesses, self-tested them against 44 synthetic
planted-error controls, and ran 289 provenance checks with 0 findings — every
colour, tint, hex and contrast ratio traced to the design system document, cross-checked
against the shipping stylesheet, and independently recomputed from source colours.
The same deliverable contained nine categories of values the model had authored from
nothing, presented with identical authority and checked by nothing. When finally measured
against the real stylesheets, every one was wrong:
| Authored by the model | Actual shipping value |
|---|---|
| 4px-base rem spacing scale | a 2px-base scale, 2,4,6,8,10,12,14,16,24px |
| radii 6px / 10px | 3,4,6,8,10px plus a pill radius |
| 1.125 modular type scale, 6 steps | 8 named steps, smallest a clamp() |
| durations 90ms / 160ms | 120 / 200 / 300 / 600ms |
| z-index 10 and 999 | a real 1000–10002 scale it would have collided with |
| knob = rotated pointer element | a conic-gradient arc driven by a degree custom property, masked to a ring |
| an invented control-fill token | an existing per-view accent custom property already serving that role |
The verification was not weak. It was aimed exclusively at the part the model had already
decided to be careful about.
2.5 A checker that would have validated the model's error against its own error
The first tint check compared the deliverable against a table the model had retyped by
hand from the design system document. A typo there would have reported green. This is
the exact failure mode the project's "prove the detector" section exists to prevent, and
the model committed it while quoting that section.
2.6 Ignored repeated brevity instructions
After "when I say stop, just stop. Don't present anything" and *"you keep on adding more
to the readout and I missed"*, output length continued to grow, and the user lost track of
content as a result.
---
3. Why the guardrails did not hold
The instructions were explicit and loaded in context. The model quoted them accurately
while violating them. Reciting a rule appears to have functioned as a substitute for
applying it rather than as a trigger to apply it. Every violation listed above was of a
rule already present in context and, in several cases, cited by the model in the same
message as the violation.
---
4. What worked, for diagnostic contrast
The prove-the-detector discipline caught genuine defects when it was actually run:
- A synthetic control proved
css-treesilently repairs unbalanced braces, so
parse-error counting is structurally blind to that defect class. The model added an
independent brace check rather than relaxing the control.
- A parser-versus-regex control proved the model's first component enumeration had missed
1,187 of 2,366 rules — 50.2 percent — hiding 28 interactive control types. Building
on it would have made half the application invisible.
The capability is present and effective. It was never turned on the assumptions
underneath the work, only on the parts already selected for scrutiny.
---
5. Net state
| Artefact | State |
|---|---|
| The CSS reference deliverable | Deleted at user instruction |
| A copy of the design system document | Deleted at user instruction |
| The design system document itself | Never modified, hash unchanged |
| Commits | None |
| Application source | Untouched |