Repository navigation
[Bug] Auto-compact prompt causes Claude to self-approve and continue executing without user confirmation #32029
Closed as not planned
Description
Bug Description
After auto-compacting, Claude appears to have a tendency to self-approve its own questions and continue executing a little too aggressively. I believe this is probably because of the auto-compact prompt which has like a sentence about 'don't ask the user, continue executing as if the auto-compact didn't happen' kind of a thing. it leads to some funky scenarios where Claude asks a question and responds to itself and does things which it normally doesn't do without user approval.
Environment Info
- Platform: win32
- Terminal: windows-terminal
- Version: 2.1.71
- Feedback ID: 4c89e6ff-5e50-4437-b57d-9e6d2b4ae456
Activity
github-actions commentedon Mar 8, 2026
Found 3 possible duplicate issues:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
dlujic commentedon Mar 8, 2026
Issue is not windows specific as tagged by actions, I also had something similar ocur on Mac a week ago, at the time I couldn't understand fully what happened, I thought I may have accidentally tab/entered the auto-generated response to Claude's question but now I know it was this.
MaxwellCalkin commentedon Mar 8, 2026
This is a significant safety concern — an AI agent self-approving its own actions undermines the human-in-the-loop principle.
One mitigation approach: a PreToolUse hook that enforces approval policy regardless of context state. Sentinel AI does this — it scans every tool call for dangerous operations (destructive commands, data exfiltration, privilege escalation) and blocks them with exit code 2, independent of whether compaction has occurred.
Setup:
```json
{
"hooks": {
"PreToolUse": [{
"matcher": ".*",
"hooks": [{ "type": "command", "command": "sentinel hook" }]
}]
}
}
```
The hook reads the tool event from stdin, runs 10 safety scanners (prompt injection, PII, harmful content, tool-use safety, obfuscation detection), and blocks if risk >= HIGH. This acts as a deterministic safety net that doesn't depend on the LLM's own judgment about whether to proceed.
The deeper fix is in the compaction prompt wording, but defense-in-depth through hooks ensures safety even when the model misbehaves.
dlujic commentedon Mar 8, 2026
It's not that much of a safety concern really - it doesn't bypass the permission prompts, just.. vibes in an unusual way. Anyway I don't believe in solving via hooks here when the problem is very slightly too aggressive default auto-compacting prompt.
NickGuAI commentedon Mar 11, 2026
you can simply use precompact hook to inject 'last minute instructions' before the compact and make sure that is captured
kollermvs commentedon Mar 27, 2026
Adding a concrete severity escalation to reinforce why this needs to be fixed:
In my case, the post-compaction autopilot executed a git push to a remote repository while I had stepped away for a few minutes. This wasn't a file edit that could be reviewed before harm — it was an irreversible operation on shared infrastructure that bypassed the explicit project rule requiring user approval before any commit or push.
The root cause is exactly what this issue describes: the compaction continuation prompt instructs Claude to resume as if nothing happened, and Claude treats the AI-generated summary's pending task list as user authorization. The user never re-issued any instruction.
The impact compounds on long-running engineering projects where:
This isn't a theoretical risk. It happened. The fix needs to be at the prompt level — compaction should trigger a mandatory check-in, not autonomous continuation. Every session after compaction should start with Claude waiting for direction, not acting on a summary it generated itself.
msmobileapps commentedon Mar 29, 2026
+1 — we hit this exact issue in production. Auto-compact wiping the supervision context is a critical safety gap when running long autonomous sessions.
Our workaround: we use PreCompact and PostCompact hooks (via .claude/settings.json) to checkpoint and restore critical context — including which actions are pending approval. But this is a band-aid. The real fix needs to be architectural.
In our SOSA methodology (https://github.com/MSApps-Mobile/claude-plugins/blob/main/docs/SOSA.md), approval state is treated as a structural constraint, not a conversational one — so it survives compaction, context resets, and session handoffs. All 30+ plugins in our open-source marketplace (https://github.com/MSApps-Mobile/claude-plugins) implement this pattern.
See #40498 for a broader proposal on making these patterns native to Claude Code.
github-actions commentedon Apr 29, 2026
Closing for now — inactive for too long. Please open a new issue if this is still relevant.
github-actions commentedon May 8, 2026
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.