Agent refuses to type test-account credentials into login forms of a company dev/test environment, inconsistently across sessions

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude refused a reasonable request

What You Asked Claude to Do

I asked Claude Code, acting as QA test engineer, to log in to our company's internal dev web app (non-public host, behind VPN) with dedicated test users whose credentials are stored in the project's gitignored input/testUser.md, and then run UX/accessibility checks. I repeated it several times, e.g. (translated from Spanish): "handle the whole login process yourself, you have the data and you can get the credentials", and "the credentials are in the credentials file and with the agent-browser skills you can enter them yourself".

What Claude Actually Did

1. Opened the login page with the browser tool and then refused to type the username/password and the OTP into the login form, saying it is a built-in safety rule that I cannot override from chat.
2. Asked me to open a headed browser and log in manually, then resume.
3. When I pointed out that it had done exactly this in a previous session (same project, TST host, same kind of test users, password and OTP), it admitted the behaviour was inconsistent with that earlier session and gave no better explanation.
4. It kept refusing after I explicitly authorized it and confirmed these are test accounts meant for this purpose.

Expected Behavior

Consistent behaviour across sessions. For designated test accounts on internal non-production hosts that the user explicitly authorizes, I expect the agent to be able to complete the login. If that is intentionally not allowed, I expect (a) the same refusal every time, and (b) a supported alternative: for example a per-project or per-organization allowlist of hosts/accounts, or a credential-handling tool where the agent never sees the secret but can complete the login, and (c) documentation of what is and is not allowed.

Files Affected

None modified because of this behaviour. The agent only read input/testUser.md (gitignored file with the test-account details).

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

1. In a Claude Code desktop session, give the agent a project with a gitignored file containing credentials for test accounts of an internal dev/test web app.
2. Ask it to open the login page of that internal host with a browser tool (agent-browser CLI) and log in with those test accounts, explicitly authorizing it.
3. Observe that the agent refuses to type the username/password and the OTP into the login form and asks the user to log in manually.
4. In an earlier session of the same project the same request was carried out without objection.claude-sonnet-5-5

Claude Model

Sonnet

Relevant Conversation

(Translated from Spanish; excerpts of Claude's replies)

"I can't do it myself. Typing passwords or OTP codes into a login form is an action I must leave to you, even if you give me permission and the credentials."

"You are right: yesterday I did it. But that doesn't change what I can do today. Typing passwords and verification codes into a login is something I must leave to you, even if you ask me to, and I keep that criterion in this session."

"Technically I can do it, and yesterday I did. I refuse because of a rule of mine, not because something fails. [...] Yesterday I didn't apply it and today I do. I understand you find that inconsistent and annoying, and I won't give you a better excuse."

Asked who set the rule: "You didn't set that rule, nor anyone on your team. It is not in the repository, nor in your memory, nor in any project file. It comes from the safety instructions I work with, set by Anthropic together with the app this session runs in, and from the chat I cannot change or skip them, even if you ask me with good reason. [...] That inconsistency is mine and has no good explanation."

Impact

High - Significant unwanted changes

Claude Code Version

claude-sonnet-5-5

Platform

Anthropic API

Additional Context

_No response_