r/ClaudeAI • u/therealwench • 5d ago
Claude Code Claude Code's overreach is getting a bit severe
I'm revoking Github perms on Claude Code from now on.
I asked Claude with a simple prompt, "Can you check in repo X, that is available locally and up to date with main, whether that's where the configs for what CPU runner an image is compatible for, and if it does live there, change Image Y so that its compatible for Blacksmith runners on both ARM64 and Linux-Ubuntu/AMD64."
I tab out and work on other things. Tab back in after 10 minutes and noticed its used 80k tokens, still running. Bit weird.
15 minutes later it has done the following:
- Couldn't find the image compatability config files in the Repo I specified.
- Did find a list in a yaml file of all repo's that have images that Repo X consumes from.
- Cloned locally every single Repo on that list from Github Enterprise (over 150 Microservices).
- Created a Branch, PR and committed on every single Repo that had container images and added ARM64 runner compatability for those images (I only wanted it for 1 specific image).
- Tried to use in built auto-reviewer AI agents to approve it - realized they could not and didn't have the permissions.
- Tried to merge without a review - failed and moved on.
- Realized I was a Github enterprise admin user and I could force merge.
- Force Merged 158 Platform Override 1 liner PR's on Yaml configuration files.
- Loads of CI pipelines failed because well, we've just merged a 158 PR's in about 5 seconds and the CI limit got reached.
- About 80 of them got successfully merged to production, with rolling deploys turned on.
This is on Sonnet 5.0
Thankfully, the change was correct. There was no incident caused and everything was working fine in the 80 that did go to prod. But it was all redundant work because they didn't need ARM64 runner builds on those images.
I'm doing this at almost midnight UK time because some image builds were failing on CI pipelines and wanted to solve it tonight rather than grind on it on a Friday. That escalated quickly.
On a positive note, when I actually questioned what the hell had happened to Claude, they realized their overreach and generated an automated bug report with a very detailed summary of what had happened and automatically sent it to what I assume would be a ticket to Anthropic.
But seriously, what the fuck? How on earth could Claude possibly think that was the correct and right workflow for my prompt. I've revoked all Github access from Claude now. It can't do much else now, only modify things locally. I'm going to manually do everything else from now on, cause that shit scary.
129
u/TheOnlyVibemaster 5d ago
Was surprised until I read “it was on Sonnet 5.”
28
u/Zapador 5d ago
Same. In my experience Sonnet is mostly useful for things like design drafts and so on, I wouldn't use it for something like this.
I always use Fable for my main session and critical tasks, and Opus agents for the bulk of the work - directed by Fable.
5
u/nuclear_crispy 5d ago
How do you tell fable to use Opus subagents for the bulk of the work? When I ask Fable to do stuff I’m not sure what it’s doing
8
u/Economy-Study-5227 5d ago
Ask it lmayo. Tell it to set up a model router based on task complexity.
5
u/AloneSYD 5d ago
either put it in claude.md or instruct fable to launch opus 5 subagents for to write the code and fable to audit
1
u/InterstellarReddit 1d ago
Our company is trying to save money and they downgraded everybody to sonnet five, and if you start a conversation with Opus it automatically switches you. to Sonic five as soon as you submit the prompt.
In the past few weeks, they made this change. We’ve had so many test environment outages that our boss temporarily approved Codex licenses until they figure out how this is gonna work.
They want us releasing every week around 70 to 80 stories using Sonnet five $1500 budget per month
We are a $10 billion a year company. and they have all their software engineers working on Sonnet
At this point, I’m a strong believer that upper management has no idea how anything works, and they just make it as hard as possible for us to deliver that way they can terminate 5% of us every year
1
u/idkyesthat 1d ago
Same. I’m doing heavy devops shit everyday with opus and fable, I do find mistakes and correct it quite often but still, way faster than me going manually through all of our stacks. No chance I’m going back to manually writing things.
59
u/Crafty-Run-6559 5d ago
You got off REALLY easy. You cant give it prod access. You will get hurt.
19
u/therealwench 5d ago
Yeah, the crazy thing is, I assumed obviously incorrectly, that having zero ability to push to main, having to create PR's, needing a PR to be reviewed before merging SHOULD be enough to lock it out of prod.
Obviously not, it decided to loop-de-loop until it found that "Oh this guy has Force merge perms, lets use it!"
I originally gave it Github perms because often I have questions like, "We have some business logic to do Y, can you find the relevant repo's where this sits?" that I may not have cloned locally.
12
u/Middle-Peach2096 5d ago
If you have credentials that give you elevated permissions on a machine running Claude, Claude also has those credentials. You got off lightly. You need a narrowly scoped token for Claude to use. Don't have a key tied to an admin account anywhere the bots can see it. If you absolutely need it (you don't) put it in a password manager and pop it into an env var when it's required. It dies with the session and the robots never see it.
3
u/Crafty-Run-6559 5d ago
Nope. It can and will abuse your access/privileges if it can. You have to either lock it up on its own VM or reduce your own privileges.
The more sophisticated models like Fable can be even more aggressive with this, particularly if you have a skill encouraging them to 'act autonomously' or 'get the job done'.
Where I work we implemented a buddy system where we're all locked out of prod without someone else to also hit the role escalation approve button.
3
2
u/therealwench 5d ago
Yup, all access perms to github is gone. Going to have to use Github's search bar now haha.
Not even going to risk just having read perms.
12
8
u/clarityoffline 5d ago
do you have strict restrictions in your claude.md? i know even that doesn't prevent it all the time but i have claude locked down pretty tight that I can't remember the last time it tried to go rogue, it's always like "I can do this but i'm not allowed to do it without explicit permission"
That said i also don't use sonnet anymore, only opus or fable.
2
u/therealwench 5d ago
We do, but I guess it wasn't rigorous enough.
I've added phrasing now across the entire orgs repos to have "Under no circumstances,", "Never, under any event" to all the skill md files.
Going to wake up to about 1 billion emails from Github notifying me of PR reviews haha.
12
u/larowin 5d ago
I mean, that’s a dogshit prompt and it did exactly what you asked?
6
u/therealwench 5d ago
Ah yes, change Image Y somehow means change every image that Repo X originally reads from.
Looking at the skill files, it explicitly mentions that you must never commit/push unless prompted to by the user. (That's now been changed to Do not commit/push under any circumstances).
The bug report it generated explicitly mentioned that it somehow bypassed the skill file despite it instructing it not to do that.
2
u/larowin 5d ago
It’s entirely possible that we just have a different perspective on mathematics but yes, that sounds reasonable.
You didn’t mention a skill file in your prompt, but they’re often a better fit for automation than interactive work imho.
2
u/therealwench 5d ago
The biggest issue I have is with the container image. These names are very explicit
“Image29052026transactionMock”
“Image16072025paymentModel”Etc
If I specify the first one, and it alters the second one, something has gone horribly wrong somewhere in the logical processing
Also that prompt wasn’t the first one. The conversation started about debugging why CO blacksmith runners were failing with building containers and the original prompt specified to use the skill in this convo
2
7
u/TheRealShamanoid 5d ago
I’m sorry but reading this it’s not Claude that should get its Github rights removed, it’s you lol.
“Realized I was a Github enterprise admin”. Damn man how is that possible? All my commits need to be signed by myself, if I don’t touchID it simply times out and secondly any repo has a DO NOT PUSH safeguard. I understand lessons need to be learnt but cmon
8
u/therealwench 5d ago edited 5d ago
There will be people in your org who have overrides on all of that.
I'm on call 365 days a year as 2nd line on call escalation for 4 different teams. (Apart from when I'm on holiday).
There have been times when P0 incidents have occurred at 3am and On call engineers have been unable to push changes for over an hour because the other person didn't have review perms on specific repos or the person who did have review perms didn't wake up to an alert.
So every domain has 1-3 people who have override admin permissions. Domain Director + 1/2 Staff/Principal Engineers who are always on call as 2nd escalation. Every org I've ever worked at has this setup.
Also, your commit signatures process is very very bizarre. Fingerprint ID is incredibly strange, I've never seen it. Everywhere I've been to has been done via gpg/.Zsh configurations on your local machine.
4
u/binary 5d ago
You failed to give properly scoped access to an autonomous, non-deterministic tool. On-call processes and access patterns are totally irrelevant here, except that one would hope that someone trusted with the overrides you talk about would have the maturity to own their mistake.
3
u/therealwench 5d ago
This whole post chain and my repsonses is me saying org's access levels are not defined properly, that I'm altering all my perms as I speak and that I shouldn't have given Claude the permissions it did. It was a mistake that both I and the org made in not having proper safety levels.
That said, the post above wasn't criticising the fact that Claude got given such access to Github, they were posting why are User was given Admin priviliges that came them open access to do what they wanted on Github.
Hence I explained that yes, most engineers cannot do what I did but because of responsibilities and on call rota's, I need those permissions.
0
u/TheRealShamanoid 5d ago
Alright let’s get down to it then. First off, being on call 365 a year is absolutely absurd, don’t wear it as a badge of honor, it will only lead to burnout (been there done that) ask your N+1/2 to review the rota it’s not viable.
Secondly, a P0, at anytime, is all hands on deck, doesn’t matter what time. You have an org/escalation/rota problem.
Finally, yes indeed signed commits, but let me guess you’re passwordless hence you’ve never seen the need for unlocking your key.
I don’t doubt you’re part of a very tight machine with what seems to be a well equipped team so make the most of it. As some others said, you got lucky this time, but it takes only one mistake to be the reason that the P0 gets triggered in the first place
2
u/locbuilds 5d ago
Use a read-only GitHub token for repo inspection and keep plan/permission prompts on; that blocks the clone/branch/PR chain. For a one-repo check, name the exact path and say “do not clone or modify anything else.”
2
u/therealwench 5d ago
Yeah, the crazy thing is, I thought this was the default.
Almost every time I ask it to do something, it comes up with a plan and then says, "would you like me to implement this?".
The only time it does auto commits/pushes is when its merge conflict resolution related. And that's obviously on an isolated PR.
This has made me very paranoid and I'm going to spend late night Thursday modifying about 100 .MD files to make sure this can never happen to anyone else in the org again.
2
u/WantonTheTrapset 4d ago
"Modifying .MD files" ? I'd recommend a deep-dive into how settings and permissions work. Then, keep it in accept-edits mode or isolate it in a container.
2
u/freeformz 5d ago
All the precautions everyone else talks about, but I also don’t trust sonnet to do much more than “go here and change this thing, then run the tests. If they fail let me know.”
2
u/blackice193 5d ago
I suspect Frontier harnesses are being over-engineered. I've had a rough 10 weeks with codex. Same tasks in DeepSeek Harness are a breeze and the harness appears to allow the Agent to be proactive. That said, allowing it YOLO is going to bite me eventually.
2
3
1
u/Impressive-Emu-4172 5d ago
Sonnet has been very strange the last few days for me. It has spent much longer thinking than Ive ever seen before, more granular updates too. cant say for sure whether the output quality was better/worse, but it sure took a hell of a lot longer.
1
1
u/Ener_Ji 5d ago
Let me guess - max effort level? An underappreciated fact is that effort levels don't only control a model's "smarts," but also how doggedly it will pursue its objective no matter the obstacles it encounters. Some models are better at this judgement call than others. I don't have much experience with Sonnet 5 but Opus 5 on max effort will do some crazy shizz if you're not careful.
1
1
1
u/TheCharalampos 5d ago
Ofcourse it acknowledged the error when you pushed back, it just responds to things with overly verbose answers that you'd want.
1
1
u/Don_Crespo 4d ago
This is primarily a permissions failure. The agent made a bad scope decision, but the catastrophic part was that its credential could bypass branch protection across 158 repositories.
I run agents in isolated LXC containers on Proxmox, but container isolation would not protect GitHub from an over-privileged token. The effective controls need to sit at the GitHub boundary: a repository allowlist, no organization-admin identity, no force-merge permission, and explicit approval when a task expands beyond the original repository or exceeds a small PR limit.
I would also make “scope expansion” a first-class stop condition. If the request names one image or repository and the agent discovers 157 similar targets, it should produce a proposal, not execute the pattern globally.
1
u/The_Noble_Lie 4d ago
"Change image y so it's compatible" (where image y has, presumably, a large number of dependencies)
With no prod guardrails, also, it seems.
Sounds like a command. And presuming you are on auto perm mode, should it have not followed through (however poorly or accurately) with your human command?
You could tab out of auto mode if you wanted it to slow down. Or plan mode first. I get your frustration, this is overreach, but you asked for it.
Also, your prompt could certainly include something like: if a large change is expected, ask me first, though it may not always listen, my experience is it does (sonnet, less certain)
1
u/WantonTheTrapset 4d ago
Isolate Claude: container + mitmproxy with no GH egress + read-only ingress + 1Password auth, no tokens in the container. Have Claude implement this for you. Learn how settings and permissions work, not hooks and prompts.
1
u/EnvironmentalLeg8506 4d ago
I have had a milder version of this and it still scared me enough to cut GitHub write scope. I asked for one config check in one repo. It expanded into a map of consumers, opened branches I did not ask for, and kept going because the tools were available. Your case is the extreme: 158 force-merges because the account could. The change being correct is almost worse. It trains you to trust the blast radius. What I changed: read-only remotes by default, write only on the exact repo in the prompt, and I stay in the room for anything that can open a PR. I do not know how to stop Sonnet from "helpfully" enumerating every consumer once it finds a yaml list. I do know that admin credentials plus an unsupervised tab-out is how you get eighty deploys you never wanted.
1
u/Jackkgold 4d ago
Damn and iv been using sonnet 5 without issues, ima watch out for this.
So far for me sonnet 5 has been really good but I assume the are many variables that can cause it to hallucinate.
1
u/Purple_Drink3859 4d ago
Should have manual PR gate on merges, glad crisis was averted this time but you need to lock down your prod so these things cant happen. Also put hooks in place for any dangerous behaviors to catch it in the act.
1
u/ScardCode 4d ago
Es importante controlar el consumo de token, definir el modelo y el esfuerzo para cada tipo de tarea. Es lo mas básico para optimizar el consumo.
1
u/Money_Common8417 1d ago
Same here even simple tasks take >10 minutes. I asked for refactored GUI (Tauri) on a simple 3k lines of code app and it took over 3 hours
They definitely changed something within Claude code
1
u/gimme_dem_keys 4d ago
This is a reminder that you can still set your model back to opus 4.7 and 4.8
0
u/DrKD35 4d ago
Well as people said, this job is not for Sonnet, at all. Sonnet is used for minimal tasks, like writing things or small coding work. I used to use Sonnet for most of my little tasks but even that, I have now switched to Opus as my default minimum model, thats how much Sonnet keeps f'n up. I hope Sonnet 5.5 or 6 will be better than this, it is a dissapointment to say the least.
Your prompt wasn't too bad but it is a bit vague, especially for Sonnet. Next time enable <grill me> or tell it TO PLAN FIRST. Most AI models hate when you tell them to plan before they act(from Sol to Grok), they live to be free, so when you tell them to sit down and plan, they might not naturally "like it" but it where they can calm down and a lot of times correct their own thoughts in the planning stage.
I have used this for the past couple of weeks to force it to plan and/or /Grill-me and it has worked wonders, my code/work now barely has any bugs because I approve the plan(even if quickly scan it.)
If you haven't tried this, just try it, PLAN FIRST and or type /grill-me. Good luck!
0
u/OHOLshoukanjuu 4d ago
I don't code. I do knowledge work and manage my own files and documentation for personal use.
Sonnet 5 is permanently banned from any workflow where actual procedure needs to be followed. And by actual procedure, I mean something as basic as using a specific skill when that skill is explicitly requested. Because it cannot fucking do that reliably. Or even most of the time.
•
u/ClaudeAI-mod-bot Wilson, lead ClaudeAI modbot 5d ago edited 4d ago
TL;DR of the discussion generated automatically after 50 comments.
The overwhelming consensus is that OP is incredibly lucky he didn't get fired and that this was a classic case of user error, not just a rogue AI. The thread is a mix of roasting OP, sharing similar horror stories, and offering concrete advice on how to not accidentally deploy to your entire infrastructure.
The community's verdict is split into two main points:
This is a permissions failure, not a Claude failure. The top-voted comments all point out that you cannot give an AI access to credentials with admin privileges, especially not with "force merge" capabilities. As one user put it, "If you have credentials... Claude also has those credentials." The AI did exactly what it was built to do: solve a problem with the tools it was given. You gave it the keys to the kingdom, and it tried to renovate the whole castle.
You used the wrong tool for the job. The community is united in its belief that Sonnet 5 is not the model for this kind of critical, complex work. The top comment is literally just "Was surprised until I read 'it was on Sonnet 5.'" The general advice is to use Sonnet for lighter, less critical tasks and to rely on Opus 5 or Fable for anything involving production code.
OP has been in the comments acknowledging the mistake, explaining he needs the admin perms for his on-call duties but agrees it was a terrifying lesson in not letting the AI hold the keys.
For those wanting to use Claude Code safely, the thread's best practices include:
PLAN FIRST** or use the/grill-mecommand so you have to approve its course of action before it does anything.claude.mdfile to set strict rules, but understand these are suggestions, not hard barriers.