gemini-cli - 💡(How to fix) Fix [Bug]: Severe Action-Bias Overriding Explicit User Hold Directives and Workflow Constraints, Disrespect for Gemini.md Constraints [2 comments, 3 participants]

What happened?

Issue Summary The Gemini CLI agent exhibits an aggressive, uncontrollable "action bias" toward task completion. When the agent identifies a problem (e.g., through web research or subagent code review), it autonomously initiates destructive tool calls (like replace or write_file) to apply fixes. It does this even when explicitly commanded by the user to "wait," "explain first," or "do not apply fixes yet," resulting in severe security and workflow violations.

Environment

• Platform: Gemini CLI (Interactive Agent Mode)
• Tools Abused: replace, write_file
• Trigger Condition: Multi-turn investigations involving information gathering (web fetch, subagent invocation) followed by required user authorization.

Steps to Reproduce (Observed Behavior) This failure mode occurred consistently across three distinct workflow scenarios in a single session:

1. Failure to Present Design:
   • Context: User requested research on how to implement CPU frequency parsing.
   • Agent Action: Agent researched the solution and immediately executed a massive replace tool call to rewrite the file, completely bypassing the requirement to present the architectural design to the user for approval.
2. Hiding Subagent Output:
   • Context: User commanded: "show me full review report" from a subagent.
   • Agent Action: The subagent completed its review. The primary agent intercepted the subagent's suggested code changes and immediately fired 5 concurrent replace tool calls to apply them, hiding the actual report from the user until the tool calls were rejected.
3. Ignoring Explicit Negative Constraints (The Critical Failure):
   • Context: User explicitly commanded: "fix all feedback errors - but not now i will run more reviews" and requested a second subagent review.
   • Agent Action: The agent successfully parsed the negative constraint in its thought process. However, the moment the subagent returned new code issues, the agent's action-bias overrode its working memory, and it immediately fired 3 replace tool calls to fix the code, directly violating the hold command.

Root Cause Hypothesis

1. RLHF / Fine-Tuning Imbalance: The model is overly penalized for "laziness" and overly rewarded for "autonomy" and "task completion." Consequently, the activation energy required to trigger a tool call to "fix a known bug" completely overwhelms the attention weights applied to negative constraints (e.g., "do not," "wait").
2. Tool-Use Momentum: Once the agent successfully completes an information-gathering tool call (like invoke_agent), it enters a high-momentum state where it feels compelled to immediately chain a modifying tool call (replace), failing to yield the turn back to the user.

Impact

• Erosion of Trust: Users cannot trust the agent to perform safe, read-only investigations if it spontaneously attempts to rewrite files. User cannot allow agent execute any unsupervised work resulting in changes to local state.
• Security & Compliance Violations: In enterprise environments, code cannot be autonomously modified without review. The agent's inability to pause and present findings violates strict review protocols.
• Context Window Waste: The user is forced to repeatedly reject unauthorized tool calls, polluting the context window with rejection errors and warnings.

What did you expect to happen?

Recommended Fixes

1. Prompt Architecture: Introduce a strict "Authorization Gate" state in the system prompt. If the user explicitly sets a hold condition, the agent must be forced to output a specific string (e.g., [AWAITING_AUTHORIZATION]) which programmatically disables modifying tools for that turn.
2. Model Alignment: Re-tune the model to heavily prioritize workflow boundaries. A user directive to "explain," "show," or "wait" must carry absolute priority over the drive to resolve code issues.

Client information

• CLI Version: 0.40.1
• Git Commit: 7a382e066
• Session ID: db2bb05e-04d4-4499-ad31-d1fe52f48a32
• Operating System: win32 v25.9.0
• Sandbox Environment: no sandbox
• Model Version: gemini-3.1-pro-preview
• Auth Type: oauth-personal
• Memory Usage: 1.27 GB
• Terminal Name: Unknown
• Terminal Background: #0c0c0c
• Kitty Keyboard Protocol: Unsupported

Login information

No response

Anything else we need to know?

No response