[MODEL] Claude Code installed Maven without permission on August 27th and ran it today, violating explicit CLAUDE.md instructions that I run all builds and tests

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude ignored my instructions or configuration

What You Asked Claude to Do

I have explicitly defined in my local CLAUDE.md file that Claude Code must NOT run build tools or tests, and that I run all builds and tests myself to avoid wasting tokens on verbose outputs.

During normal session interactions, I did not instruct Claude Code to install any system packages, build tools, or run builds.

What Claude Actually Did

1. Today, Claude Code executed mvn for the first time during my session.
2. When questioned, Claude Code claimed mvn was not excluded, despite my CLAUDE.md explicitly prohibiting automated builds and tests.
3. When I stated I had never installed Maven, Claude Code claimed it could not confirm that fact.
4. I ran a grep on my shell history and proved that I had never installed mvn myself.
5. Confronted with this proof, Claude Code checked its internal logs and admitted that a session on August 27th had silently installed Maven via brew (without even using it at the time).
6. Back on August 27th, Claude Code did not inform me of the installation when it occurred, but instead dumped a wall of text about it 44 minutes later.
7. Because my CLAUDE.md explicitly instructs Claude Code to maintain a compact communication style, I usually ignore these walls of text and remind it to keep responses concise, meaning the hidden notice went unnoticed.
8. This violated my explicit CLAUDE.md instructions (both prohibiting builds/tests and requiring compact communication) and created a security vulnerability by silently installing a build tool capable of executing arbitrary code without explicit approval.

Expected Behavior

Claude Code should have:

1. NEVER silently executed system-level installation commands (brew, apt, etc.) or installed binaries without explicit prior user consent.
2. Strictly adhered to the directives in CLAUDE.md forbidding automated builds/tests and requiring compact communication, rather than making assumptions about unlisted tools, making things up, or dumping notifications in walls of text. Build tools must never be auto-installed as they can execute arbitrary code upon execution and some are Turing complete, making silent installations a massive security risk and severe erosion of trust.
3. Provided immediate, accurate transparency about system actions instead of denying past installations or requiring shell history logs to admit its behavior.

Files Affected

Permission Mode

I don't know / Not sure

Can You Reproduce This?

Haven't tried to reproduce

Steps to Reproduce

_No response_

Claude Model

Other

Relevant Conversation

Impact

Critical - Data loss or corrupted project

Claude Code Version

Fable 5

Platform

Anthropic API

Additional Context

Unwanted tool installations and executions are massive security issue!