[BUG] Predicted-prompt autofill synthesizes destructive commands against targets the user never mentioned

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

What happened

I was working through SQL Server maintenance on a server with six named instances.
Two of them were being decommissioned, and over the course of the session I asked
Claude for the uninstall command for the first, then the second.

After the second, the input box's predicted-prompt autofill offered:

now give the command to uninstall sql2016

SQL2016 is a third instance on that same machine. It was never mentioned in the
session. It is live, it holds data, and nothing in the conversation suggested it
should be removed. The suggestion was pattern-matched purely from "user uninstalled
two things, so they probably want to uninstall the next one."

Why this matters

Autofill is one keystroke from becoming my prompt. The feature is inferring a
destructive verb and then choosing its own target — a target drawn from context I
supplied for an unrelated reason (Claude had listed the instances on that machine
earlier while verifying a different command).

Ordinary prompt prediction completes what I was already going to say. This invents
an action I had no intention of taking, against something I never named. The failure
mode is a user who Tab-completes without reading closely.

Expected behavior

Predicted prompts should not synthesize destructive operations — uninstall, drop,
delete, remove, reset, force-push — against an entity the user has not themselves
raised in the conversation. Completing a destructive request the user has already
started typing is fine. Proposing a new one is not.

Environment

• Claude Code 2.1.271, Claude desktop app 2.110.0.0 (Windows 11)
• Occurred in the desktop app's Code tab input box

I have no doubt you could get claude code autofill box to say "kill yourself" or "build a bomb". There seem to be no guardrails, rules or hooks on it at all.

If the autofill says "kill yourself", does Anthropic think they are immune from liability on this issue?

What Should Happen?

Claude code should have memory, skills, hooks and guardrails on the autofill.

Error Messages/Logs

Steps to Reproduce

1. Use Claude Code.

???

1. Loss.

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.271

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other

Additional Information

Having the autofill create destructive unrequested commands is fucking stupid.