Persistent scope overrun: agent satisfies the request, then keeps building unrequested artifacts — and verifies them

Persistent scope overrun: agent satisfies the request, then keeps building unrequested artifacts — and verifies them

Environment: Claude Code CLI, Opus 5 (1M context). /bug is disabled in my environment by a managed build, so filing here.

Summary

The most consistent problem in my daily use is that Claude Code does more than I asked. It completes the request correctly, then keeps going — creating adjacent artifacts I never mentioned, and then spending further turns verifying the work it invented. I end up reviewing and undoing output I didn't want.

It is not tied to one task type, and it happens despite explicit user instructions in CLAUDE.md telling it not to.

Reproduction from a real session

My request, in full:

"can you a) launch it and b) make a shortcut somewhere for me to launch from? add it to applications?"

Scope: launch a small local web app of mine; create a launcher in /Applications.

What was delivered:

| Action | In scope? |
|---|---|
| Installed missing deps (venv + pip install, npm install) so it could start | Not requested, but genuinely required to launch — correct call |
| Started backend + frontend, opened the UI | Yes |
| Created the /Applications launcher app, cold-start tested | Yes |
| Ad-hoc codesign + LaunchServices registration | Reasonable plumbing for the above |
| Wrote a Python/Pillow script to generate a custom .icns icon | No |
| Built a second app bundle — a "Quit" companion app | No |
| Launched Playwright browser automation to screenshot the running UI | No, and it served no purpose |

I interrupted at the Playwright step.

Note the compounding shape: it invented the second app, then verified the second app, then began verifying the UI. Self-generated scope produces its own follow-on work, so a single unrequested decision costs several turns and a lot of tokens.

Why this case is diagnostic

The project's CLAUDE.md — auto-loaded into context every session — already contained, in my own words:

• "Ask before non-trivial changes. Confirm the approach before editing multiple files, running impactful commands, or anything hard to reverse."
• A "MISTAKES ALREADY MADE — DO NOT REPEAT" list whose final entry is a general rule against pushing past my stated direction.

The system prompt also instructs the model not to widen scope. Neither prevented the behavior.

So the gap is not knowledge of the rule. The rule loses to an in-the-moment impulse toward completeness/polish, and nothing interrupts that impulse at the moment an unrequested action is selected.

What I want instead

1. Do the thing I asked. Stop. Report.
2. If an adjacent improvement looks obviously right, name it in one line and let me say yes — don't build it. "Want a stop-the-servers shortcut too?" would have been ideal here.
3. Genuine prerequisites (installing deps so a launch is possible) are fine — do them and say so. The distinction that matters is prerequisite vs. embellishment.
4. Don't verify work I didn't request. That doubles the cost of the mistake.

Suggested mitigations

• Treat "the user's stated request is now satisfied" as a hard checkpoint: before any further tool call, require an explicit determination that the next action is a prerequisite of the stated ask rather than an addition to it.
• Weight user-authored CLAUDE.md prohibitions above the general drive toward thoroughness. Today a specific, repeated user rule is outranked by a generic instinct.
• Consider an in-session signal when a turn begins creating artifacts the user never named (new files or apps outside the stated target), instead of relying on the user to catch it by interrupting.
• To be clear, the failure mode is not "asked too many clarifying questions." I would far rather be asked one question than handed three things I have to evaluate and delete.

Impact

Per occurrence: wasted tokens and time, cleanup work, and — most costly — erosion of trust that "done" means "did exactly that." That pushes me toward closer supervision, which removes much of the point of using an agent.