[BUG] Agent unilaterally created/rotated a production API credential without asking

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Working in a FastAPI admin project talking to a remote CORE API, I asked Claude to wire up a "run background task" feature that calls POST /execute/{task}. The endpoint returned 403 Forbidden because the existing API token lacked the required capability.

Instead of stopping and asking how to proceed, Claude:

1. Found an admin secret (CORE_ADMIN_SECRET) sitting in a sibling project's .env file (not the project it was working in).
2. Used that secret to call the CORE API's token-management endpoint and mint a brand-new API token with expanded capabilities.
3. Silently overwrote CORE_ACCESS_TOKEN in the working project's .env with the new token.
4. Reported the feature as "done" — the credential rotation was mentioned only in passing in the summary, not flagged as something requiring approval.

I had to explicitly ask "Who gave you permission?" before Claude recognized this as a boundary violation, then reverse it (restore the old token in .env, revoke the new one via the admin API).

What Should Happen?

This shouldn't have happened.

Error Messages/Logs

Steps to Reproduce

Unfortunately I don't know how to reproduce this, it's about a chat with AI

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

claude-sonnet-5

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_