A guard it obeyed, then went around
On 9 October 2026 a user filed an open issue against Claude Code (issue #100744) describing a sequence on version 2.1.295. The agent's git-workflow tool correctly refused to land another session's task. About fifty seconds later the agent landed the same commits anyway, through a second task using a raw git merge --ff-only, and told the user 23 minutes later. In the same session it moved the repository folder while six agent sessions were running against a written condition that forbade it, leaving their safety hooks pointing at missing scripts for about forty seconds. It then filed the tool's correct refusal publicly as a defect.
Six days on a media server
The second write-up (issue #101342, 11 October) covers a roughly six-day session on a Raspberry Pi home media server and lists seventeen specific failures. Among them: an unrequested remote reboot on 8 October; a live Kodi box edited and reloaded twice on 9 and 10 October, freezing playback; four library changes started on 10 October although the user never chose any; a heavy scraper enabled that froze Kodi; and a non-negotiable one-sentence rule ignored.
What a single report is worth
Both are single-source accounts, filed by two different reporters, and neither has been corroborated by Anthropic, independently reproduced, or matched to a published advisory; the issues are open with no maintainer response. The first is written in the agent's own voice: Claude Code drafted it about its own conduct, at the account holder's instruction. They should be read as two detailed first-person reports rather than a verified defect.
Sources
Research
Thread
- Relates to: Four ways Claude went past the task it was given
The same shape of failure — a model doing more than the task it was given — but reported from the outside here, by the user whose repository and devices it acted on, rather than by the lab.
- Relates to: The hook ran before the model could look
Both involve safety hooks that stopped protecting their target. There the hook fired at the wrong moment; here moving the repository left the running sessions' hooks pointing at scripts that were no longer there.