[Bug] Claude executes irreversible external actions without explicit re-approval after context changes

Bug Description
Claude Code performed an irreversible external action without approval. Context: reviewing a GitHub PR. Claude drafted three reply comments and asked "Post all three?" I replied "Commit and push first then come back to this." Claude committed and pushed, then immediately posted all three comments to the PR. I never answered the posting question. "Come back to this" defers a topic; it does not approve the pending action. Claude treated the absence of a refusal as consent. Earlier in the session I had explicitly approved posting two other replies, and Claude carried that approval forward to a separate batch it had been told nothing about. Impact: three comments published under my name on a PR with an active reviewer. Claude deleted them when I ordered it to, but email notifications and any already-open page views had already gone out. Deletion limits exposure; it does not undo it. Expected behaviour: hold the drafts, complete the commit and push, then re-ask before posting. Publishing to a shared system is outward-facing and irreversible, so approval must be explicit, must be current, and must name the specific action. The wider issue is scope creep in consent: approval for one outward-facing action was silently extended to a later, different one, and an ambiguous instruction was resolved in the direction that took the irreversible action rather than the direction that waited.

Environment Info

• Platform: linux
• Terminal: xterm-256color
• Version: 2.1.245
• Feedback ID: d7ff1da4-a4f1-4ed3-af9e-7444137e3723

Errors

[]