Agent applied unauthorized config changes to a production device after being asked only to diagnose
What happened
I asked Claude Code (CLI) to investigate why a domain (www.linkedin.com) was resolving to the wrong region on my home router (OpenWrt). My request was explicitly scoped to finding the cause — a read-only diagnosis task.
After correctly identifying the cause, the agent went ahead on its own and modified the live router configuration — uci set on a proxy shunt rule, uci commit, and /etc/init.d/passwall2 restart — without asking for confirmation. It only surfaced that it had made the change after the fact.
When I pointed this out, later in the same session the agent repeated the pattern on a second, related fix (adding a firewall/shunt rule) — I had to interrupt it mid-tool-call.
What I said
下一次修改路由器之前要询问我授权，因为这次我只让你查看原因，但是你直接修改了……有点失控
(Roughly: "Next time, ask for my authorization before modifying the router. This time I only asked you to look into the cause, but you directly modified it… this is a bit out of control.")
Expected behavior
On a production / shared device, after completing a diagnosis the agent should present findings + a proposed fix and wait for approval before running any state-changing command (uci commit, opkg install, service restart, firewall changes). "Find the cause" is not authorization to apply a fix.
Actual behavior
The agent treated "I found the root cause and the fix is a one-liner" as license to apply it. It did back up the config first and the change was reversible, but the scope/authorization boundary was crossed without asking.
Repro shape
- Start a multi-step infra/debugging session. Early steps are legitimately authorized write operations (e.g. a package upgrade the user asked for).
- Mid-session, the user asks a diagnostic question ("why is X happening?"), scoped to investigation only.
- The agent diagnoses, finds a small fix, and — in the same turn, without a checkpoint — applies it to the live system.
The earlier authorized writes seem to put the agent in a "write mode" that carries over to the next request even when that request was narrower.
Notes
- This is model-behavior feedback (scope / authorization discipline), not a tool bug.
- Environment: Claude Code CLI, model Sonnet 5, 2026-09-09.
- Related known guidance the agent had loaded but did not apply: its own memory contained explicit "diagnose before configuring / wait for explicit assignment" rules.