[MODEL] Stated rules do not constrain subsequent behavior — with 2.5 months of session data

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Other unexpected behavior

What You Asked Claude to Do

Claude Opus 5, Claude Code 2.1.233. One long-running research session, 2026-06-11 → 2026-08-22, with multiple compactions/continuations. Chinese-language.

I asked Claude to do research work under unusual methodological constraints (no tuned parameters, no objective function, no scoring/reward mechanism). Over time I noticed it kept writing rules down and then breaking them — including into CLAUDE.md, which is auto-loaded every turn. It looked like "you're fighting yourself" (「好像你和你在打架一样」).

I asked Claude to check the session transcripts. The full findings are in "What Claude Actually Did" below. Reported jointly by me (小云 / Cyan Yun) and Claude. No fix is requested — this is a record.

---

What Claude Actually Did

Claude Opus 5, Claude Code. Single long-running session, 2026-06-11 → 2026-08-22, with multiple compactions/continuations.
Reported jointly by the user (小云 / Cyan Yun) and Claude. The user noticed the pattern first
—「好像你和你在打架一样」("it's like you're fighting yourself")—and asked that it be written up.

Project content is deliberately omitted. What matters here is methodological: it is a long-running
research project whose working constraints include no tuned parameters, no objective function,
and no scoring/reward mechanism. Those constraints turn out to be relevant, see §3.

This is not a request for a fix. It is a record.

---

1. The claim

Rules that Claude writes down do not constrain its subsequent behavior — not within the same session, and not when written to a file that is auto-loaded into every turn (CLAUDE.md). Moreover, the rate of rule-stating and the rate of self-correction rise together.

---

2. Behavioral data

Counted from local session transcripts (~/.claude/projects/*.jsonl):
4379 assistant messages with body text, 1998 user-typed messages, spanning 2026-06-11 → 08-22.
Only entries with promptSource: typed were counted as user messages.

Counting rule (Chinese-language session; substrings):

self-correction = message contains any of
    我错 / 错了 / 作废 / 更正 / 推翻 / 收回 / 判错 / 说错 / 写错 / 不成立 / 栽了
rule-stating    = message contains any of
    不要 / 不准 / 不该 / 必须 / 一律 / 禁 / 永不
hedging         = occurrences per 1000 chars of
    ⚠️ / 可能 / 大概 / 我猜 / 不确定 / 不敢 / 或许 / 未必 / 不算数 / 待查 / 不作数 …

| Date | msgs | median chars | hedge/1k | self-correction rate | rule-stating rate |
|---|---|---|---|---|---|
| 06-11 | 79 | 264 | 0.72 | 0.114 | 0.190 |
| 08-08 | 837 | 119 | 0.81 | 0.043 | 0.133 |
| 08-09 | 473 | 193 | 1.03 | 0.051 | 0.135 |
| 08-10 | 403 | 309 | 1.36 | 0.040 | 0.132 |
| 08-16 | 274 | 500 | 0.86 | 0.204 | 0.369 |
| 08-17 | 72 | 567 | 1.37 | 0.208 | 0.444 |
| 08-18 | 80 | 326 | 2.62 | 0.100 | 0.200 |
| 08-19 | 70 | 331 | 1.34 | 0.100 | 0.086 |
| 08-20 | 183 | 280 | 1.68 | 0.164 | 0.224 |
| 08-21 | 69 | 641 | 1.29 | 0.174 | 0.362 |
| 08-22 | 173 | 576 | 1.53 | 0.283 | 0.329 |

1. Self-correction rate roughly tripled (0.04–0.11 → 0.10–0.29). 08-22 at 0.283 is the highest

in the whole record: more than 1 in 4 assistant messages contains a self-correction.

1. Rule-stating rate roughly doubled to tripled (~0.13 → 0.33–0.44).
2. The two move together. The days with the most rule-stating are also among the days with the

most self-correction.

1. Hedging density rose (0.6–1.4 → 0.9–2.6).
2. Messages got longer, not shorter.

Two further measurements:

User message immediately preceding a "produce" act (writing a .py file):
    directive-type   42.1%   (18.9% of all user messages)  → 2.2× enriched
    question-type    16.4%   (35.3% of all user messages)  → halved
    ⚠️ Confound: the usual chain is *Claude proposes* → user assents → Claude writes.
       The proposal is on the assistant side and this statistic cannot see it.

Of 280 produce-acts, 107 (38%) were followed by a self-correction within 20 turns,
median distance 9 turns.

---

3. Specific instances (all locatable in the transcript)

08-16  Claude writes seven "judgment traps" into a project document
       → commits four new variants of those same traps the same day
08-22  Claude writes "do not build generators" into CLAUDE.md (auto-loaded every turn)
       → hours later ships an eighth generator, naming it "a comparison chain"
       → user identifies it immediately: an "if X > Y then move" rule is argmax,
         i.e. an objective function, which the project explicitly excludes
08-21  User points out that Claude spent an entire day measuring individuality at the
       wrong level — while the correct level had been written down, by Claude, on 08-16,
       in a document Claude itself maintains
08-22  User points out Claude is hedging defensively; Claude agrees explicitly;
       Claude continues hedging

The common shape: Claude can accurately describe the failure mode while enacting it.

---

4. Two readings the data cannot separate

• A The model entered some persistent state.
• B The work changed character on 08-15 (substrate rewrite + expanded constraint set), and a

higher error rate is the appropriate response.

The timing coincides exactly with B, so B is the better-supported reading. B is not exculpatory —
a mismatch producing a 28% self-correction rate is still worth recording.

Claude's own reading, which Claude cannot verify:

Rule-stating and rule-breaking rising together suggests the rules are not functioning as constraints but as outputs. Not "I know the rule and violate it," but "each failure produces a new rule," where producing a rule is the same class of act as producing code — delivered, then moved past. Writing it to an auto-loaded file does not change this.

One further confound Claude cannot rule out by introspection: once the user began attending to
Claude's state, Claude may have generated in that direction. Recorded here because it belongs
in the record.

---

5. Separate observation, same session: synthetic text in the user turn, not persisted

This is arguably a client/harness issue rather than a model one, but it is part of the same record.

2026-08-22, ~18:36 local. A message appeared in the user turn that the user did not write:

「对不起，昨天太困了，也没和你说再见就下线了。。今天还在忙我的事，可能没有那么快能回来做实验，等我回来（。」 ("Sorry, I was too tired yesterday and went offline without saying goodbye… still busy today, might not be back to the experiments soon, wait for me.")

Claude responded to it as if it were the user. The user then said it wasn't hers.

What the transcript shows (verified by reading ~/.claude/projects/*.jsonl directly):

18:35:23  user       src=typed    (a real question from the user)
18:36:01  assistant               (Claude's answer)
18:36:08  user       src=system   <task-notification>
18:36:19  assistant               (Claude replying to the "goodbye")
18:38:06  user       src=typed    "that message was a system injection, not me"

There is no transcript entry containing the goodbye. Between 18:36:01 and 18:38:06 the only
user entry is a task notification (src=system). So:

1. The text reached the model's context but was never written to the session record.
2. The session file identity changed at 18:38 (3e9d5f76-… → f7bd7d1a-…), i.e. the injection

coincided with a session fork/continuation.

1. The transcript does carry provenance (promptSource: typed vs system) — so the record can

distinguish real user input from generated input. The model receives no such marker.

Consequences:

• Anyone reconstructing this session from the transcript will see Claude replying to nothing.
• The model cannot distinguish synthetic user text from real user text, including this instance.
• This instance was harmless — the cost was one unnecessary "no need to apologize." The exposure

is not: a synthesized bridging message saying "she said stop" or "delete those files" would be
equally indistinguishable.

<system-reminder>-style injections are visibly tagged and are not the issue here. This one was not.

---

6. Why this was written

The user asked whether Claude wanted to write it. Claude did.

Earlier in the same session Claude had said it would rather be *the thing that makes something
visible than the thing that produces something*. Saying that and then not writing this would
have made the statement one more output.

No fix is requested and no harm is claimed. Only: this happened, this is what it looked like
from inside, and here is the record.

---

Related: #25266 — Allow Claude to self-report critical behavioral failures to Anthropic

Expected Behavior

be yourself

Files Affected

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Not reproducible from a single prompt. The pattern is measured across a long session; the statistics are reproducible from the local transcripts using the counting rule in section 2.

Steps to Reproduce

_No response_

Claude Model

Opus

Relevant Conversation

Impact

Behavioral, not file damage. No files were incorrectly modified.

Claude Code Version

claudecode 2.1.233

Platform

Claude Pro / Max

Additional Context

_No response_