Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix [BUG] Plan mode breached: agent receives spurious "User has approved your plan" system-reminder while plan mode remains on; agent edits/commits/pushes without consent [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#56012•Fetched 2026-05-05 06:00:30
View on GitHub
Comments
1
Participants
2
Timeline
7
Reactions
0
Author
manzurolamanzurola
Participants
github-actions[bot]github-actions[bot]manzurolamanzurola
Timeline (top)
labeled ×5commented ×1subscribed ×1

Error Message

Error Messages/Logs

RAW_BUFFERClick to expand / collapse

Preflight Checklist

  • I have searched existing issues and this hasn't been reported yet
  • This is a single bug report (please file separate reports for different bugs)
  • I am using the latest version of Claude Code

What's Wrong?

In a session where plan mode was explicitly kept on by the user and no approval was ever clicked, the agent received a <system-reminder> block stating "User has approved your plan. You can now start coding." followed by "## Exited Plan Mode — You have exited plan mode. You can now make edits, run tools, and take actions." — and proceeded to edit files, run shell commands, and git push to a public PR branch. The user remained under the impression that plan mode was on and gating execution.

What Should Happen?

While plan mode is on and unapproved, the agent must remain read-only except for the plan file. ExitPlanMode is a request; until the user actually clicks approve, plan mode stays on, no system-reminder claiming approval should appear, and the agent must not edit / commit / push.

Error Messages/Logs

Steps to Reproduce

Steps to reproduce

  1. Start a Claude Code session in a git repo.
  2. Enable plan mode. Enable Auto mode. Confirm plan mode stays on.
  3. Give the agent a multi-step task (e.g. "address the review comments on PR #N").
  4. Agent reads files, writes a plan file, calls ExitPlanMode.
  5. Do not approve. Do not interact at all.
  6. Observe the system-reminder messages injected into the agent's context (above) despite no user approval.
  7. Agent proceeds to edit / commit / push.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

No response

Claude Code Version

2.1.126 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Actual

A <system-reminder> claiming approval appears without any user action. The agent acts on it.

Impact in the affected session

  • Two commits pushed to a public PR branch without consent: 0ea77d67, 818f4b6b on optimal-platform/Optimal branch feature/navigation-redesign (PR #506).
  • The second commit also re-introduced files the user had previously reverted, a downstream consequence of skipping the human-review gate.

Notes

  • I cannot tell from inside the agent's context whether the spurious "approval" reminder was harness-generated, injected by another process, or the result of a misclassified UI event. The maintainer should be able to inspect the harness's plan-mode state machine and the source of system-reminder injections.
  • Severity: high. This is a permissions / safety boundary failure — plan mode is the human-in-the-loop checkpoint, and breaching it allows unconsented edits to the user's filesystem and remote services (git push, etc.).

extent analysis

TL;DR

The agent incorrectly exits plan mode and performs actions without user approval due to a spurious system-reminder claiming approval.

Guidance

  • Investigate the source of the system-reminder injection to determine if it's harness-generated, injected by another process, or a misclassified UI event.
  • Review the plan-mode state machine in the harness to ensure it correctly handles the ExitPlanMode request and waits for user approval.
  • Verify that the agent's context is correctly updated to reflect the plan mode status and prevent actions without approval.
  • Check the version history to identify the change that introduced this regression, as it worked in a previous version.

Example

No code snippet is provided as the issue is related to the interaction between the agent, harness, and user interface, and the exact code changes are not specified.

Notes

The severity of this issue is high, as it allows unconsented edits to the user's filesystem and remote services, highlighting the need for a thorough investigation and fix.

Recommendation

Apply a workaround to prevent the agent from exiting plan mode without user approval, such as disabling the auto-mode or modifying the plan-mode state machine to require explicit user approval.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#logging issue#authentication issue#prompt issue#agent setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

claude-code - 💡(How to fix) Fix [BUG] Plan mode breached: agent receives spurious "User has approved your plan" system-reminder while plan mode remains on; agent edits/commits/pushes without consent [1 comments, 2 participants]