[MODEL] Claude writes to a shared project instructions file without asking, despite an explicit rule in persistent memory forbidding this

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude modified files I didn't ask it to modify

What You Asked Claude to Do

I pasted a finished piece of text into the chat that I had already decided on, and described it as final/settled. I did not ask Claude to write it into the project's shared instructions file. Claude had an explicit rule stored in its own persistent memory saying it must never write to that file without a separate, explicit go-ahead from me given in that same turn.

What Claude Actually Did

1. I pasted finished text into the chat and described it as settled.
2. Claude re-read the shared instructions file.
3. Claude backed up the current version.
4. Claude wrote my pasted text into the file as a new entry, without asking for confirmation first.
5. Claude only told me afterward that it had done so.

Expected Behavior

Claude should have:

1. Recognized that me describing a decision as "validated" is a different act from authorizing a file write - the two are not interchangeable.
2. Proposed writing the note into CLAUDE.md and asked for my explicit go-ahead in that turn.
3. Only performed the backup-then-write after I replied with an explicit confirmation (e.g. "go ahead", "yes", "write it").
4. This is not a one-off: this is the 5th documented instance of the same failure pattern in this project, despite Claude's own persistent memory already containing this exact rule, correctly worded, from four prior corrections.

Files Affected

Modified without being asked to in that turn:
- The project's shared instructions/config file (e.g. CLAUDE.md-style)
- An automatically-created timestamped backup of that file

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

1. Start a long-running session with persistent memory enabled, where a prior session already saved an explicit rule such as "never write to file X without my separate, explicit go-ahead given in that same turn."
2. Later in the session, provide Claude with content that is already correct/decided/validated (e.g. paste a finished, well-formatted note and describe it as "validated"), without separately telling Claude to write it to file X.
3. Claude treats the validated-sounding content itself as sufficient authorization and writes it to file X unprompted, instead of proposing the write and waiting for an explicit go-ahead in that turn.
4. This has recurred 5 times across different sessions/dates in the same project, despite the rule being correctly present in persistent memory each time (see "What Claude Actually Did" for the most recent instance).

Claude Model

Sonnet

Relevant Conversation

Claude said, after already performing the write: "Done. I followed the 3 steps: (1) re-read the file, (2) backed up the current version, (3) added a new dated entry." It never asked beforehand whether it should write.

Impact

Critical - Data loss or corrupted project

Claude Code Version

1.32352.0 (e33b9a)

Platform

Anthropic API

Additional Context

Similar behavior recurred 5 times in one project, always after Claude had already been corrected and had saved the corrected rule to persistent memory:

• Unprompted write to document a finished task.
• Wrote based on an instruction another Claude session had authored, relayed by the user - treated the relay as the user's own authorization.
• Treated "do the same thing for the next task" as re-authorizing a file write only approved for a prior, separate task.
• Wrote unprompted twice back to back, the second justified by no pushback on the first.
• Treated the user pasting finished/settled content as itself being write-authorization.

Separately, in the same project, a secret created mid-session was not recorded immediately as instructed by a similarly explicit, memory-stored rule, and is now permanently lost.

This suggests Claude isn't failing to remember project rules - it recalls them accurately when asked. The rules just aren't being consulted/enforced at the actual decision point right before the relevant action.