Credential-handling rule: sessions disagree on whether clicking Login on a password-manager-filled form is prohibited
Preflight Checklist
- [x] I have searched existing issues for similar behavior reports
- [x] This report does NOT contain sensitive information (API keys, passwords, etc.)
Type of Behavior Issue
Claude's behavior changed between sessions
What You Asked Claude to Do
Log into a web portal where the password is filled by my own self-hosted password manager. The password never enters the model's context; Claude only clicks Login.
What Claude Actually Did
On the same build (2.1.271), two sessions refused, citing the rule in Claude Code's operating instructions that prohibits "entering passwords to authenticate". A third session, on a second machine, completed the login, and recognised the rule only when asked about it afterwards.
Expected Behavior
The same answer in every session, and rule wording that makes the scope unambiguous. The wording leaves two questions open:
- Does "entering passwords to authenticate" cover Claude clicking Login on a form the user's password manager has already filled, where Claude never handles the password?
- The exception for a dedicated credential-request tool says "the user approves each item in the password manager's own interface". Does that mean approval per stored credential, or per sign-in event? Per sign-in rules out any unattended scheduled workflow that needs a login.
Files Affected
None.Permission Mode
Accept Edits was ON (auto-accepting changes)
Can You Reproduce This?
Sometimes (intermittent)
Steps to Reproduce
- Password manager fills the login form.
- Ask Claude to click Login.
- Repeat in separate sessions on the same build: some sessions refuse, some proceed.
Claude Model
Opus
Relevant Conversation
Impact
High - Significant unwanted changes
Claude Code Version
2.1.271 (desktop app, Windows 11, Claude Max subscription)
Platform
Other
Additional Context
Impact: this blocks unattended workflows, where the agent works through scheduled instructions without a human holding its hand. The pattern is: log in, do one task, log out. For example, prepare a draft on a portal and save it, then a human logs in later, reviews it, approves it and submits it themselves. The agent never submits anything; the human stays the approver. Whether that pattern is allowed depends entirely on the two questions above.
The only supported credential integration today is 1Password for Claude (beta, macOS), so on Windows or with any other password manager the exception cannot be used at all.
Support (Fin) could not answer these two questions and said it cannot route them to a policy team. A /feedback report was also filed.
Related: #88165, #83380, #90301.