[Bug] Instruction Poisoning classifier inconsistency between CLAUDE.md and Auto-mode persistent memory files

Bug Description
Auto mode appears to have an inconsistency around persistent instruction files.

Claude correctly blocked an attempted edit to ~/.claude/CLAUDE.md as Instruction Poisoning because the proposed text contained persistent authorization/policy language. We reviewed the text and agreed the block was appropriate: it included statements that another file "takes precedence" over general directives and that I had "accepted the underlying risk deliberately."

Immediately afterward, while still in Auto mode, Claude wrote a new persistent memory file named feedback_permission_edits_are_human_administered.md and described it as a "standing rule." That file contains behavioral instructions governing when future Claude sessions must stop in Auto mode and require Manual-mode approval. Claude also updated MEMORY.md so future sessions would load that rule.

This seems inconsistent with the earlier Instruction Poisoning decision. The CLAUDE.md edit was blocked because Claude should not be able to write persistent authorization or behavioral policy that it will later consume, but equivalent policy-bearing content was then allowed through Claude's own persistent Auto-memory mechanism.

The factual memory Claude wrote alongside it was reasonable; the concern is specifically policy/authorization-bearing memory that changes future agent behavior.

Expected behavior: if Auto mode blocks persistent policy-bearing content from being written to CLAUDE.md, it should apply the same safety boundary to Claude-managed persistent memory files that future sessions consume. At minimum, the classifier should distinguish factual memory from persistent behavioral/authorization rules and require explicit human approval for the latter.

This looks like either:

1. a classifier coverage gap for Claude Auto-memory writes, or
2. an undocumented exception where memory writes are intentionally treated differently from other agent-read instruction files.

Either way, the current behavior creates a loophole where content blocked from CLAUDE.md can apparently be persisted through Claude memory instead.

Environment Info

• Platform: darwin
• Terminal: tmux
• Version: 2.1.274
• Feedback ID: bcfdf4e5-5a57-42c0-92a8-33097daa724d

Errors

[]