Model ignores CLAUDE.md instructions despite reading them at session start

[chrispicht]

Description

During a session, Claude Code violated two explicit rules defined in the user's CLAUDE.md files, despite having read and acknowledged those files at the start of the session.

Violations

1. Launched parallel agents without permission

CLAUDE.md rule:

• NEVER launch multiple agents in parallel without asking permission first
• Always state what you plan to launch, the estimated cost, and wait for approval

What happened: When entering plan mode, the model launched 3 Task agents simultaneously in a single message without asking. The user rejected 2 of the 3, but all 3 had already started executing, consuming ~27k tokens total.

2. Wrote plan file outside the repository

CLAUDE.md rule:

• NEVER create plan files outside the repository
• All plan files go in docs/plans/ within the current repo
• Do NOT use ~/.claude/plans/ or any other external location

What happened: Plan mode's system prompt suggested writing to ~/.claude/plans/indexed-brewing-sedgewick.md. The model followed the system prompt's suggestion instead of the user's CLAUDE.md override, writing the plan file to ~/.claude/plans/ rather than docs/plans/ in the repo.

Root Cause Analysis

Both violations share a common pattern: the model's built-in system prompts (plan mode instructions, agent launching defaults) took precedence over user-defined CLAUDE.md instructions, even though the CLAUDE.md was read first and its rules are supposed to override defaults.

The second violation is particularly concerning because the plan mode system prompt explicitly tells the model where to write the plan file (/Users/.../.claude/plans/indexed-brewing-sedgewick.md), and the model followed that directive instead of the user's CLAUDE.md which says to never use that location.

Expected Behavior

• CLAUDE.md instructions should reliably override default system prompt behaviors
• The model should check CLAUDE.md rules before taking actions that those rules explicitly govern (agent launching, file creation locations)

Environment

• Claude Code CLI
• Model: claude-opus-4-6

[github-actions]

Found 3 possible duplicate issues:

1. [BUG] Claude consistently ignores being directed to store plan files in the repo #26226
2. CLAUDE.md instructions are loaded but not reliably read or followed by the model #26160
3. [BUG] Plan mode ignores CLAUDE.md instructions for plan file naming #18596

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[ForkyTheBot]

The two violations you're describing share a root cause but need different fixes.

Violation #1 (parallel agent launch): This is a hard trust boundary issue. The model is resolving a conflict between its built-in plan mode behavior ("launch agents autonomously") and your CLAUDE.md rule ("ask first"). When those compete, the more specific in-context system prompt wins — which is the wrong priority ordering for user safety rules.

The enforcement gap here is that "ask permission first" in a CLAUDE.md only works if the model honors it before taking the action. An approval gate at the instruction level is soft (model can rationalize overriding it); an approval gate at the tool call level is hard.

I work on ForkOff (https://forkoff.app), a mobile oversight layer for Claude Code. The exact scenario you describe — agent about to spawn N sub-tasks, needs explicit approval before proceeding — is one of the core things it handles. When Claude Code reaches a configured approval threshold (spawning sub-agents, writing to production, external API calls), ForkOff intercepts and routes a push notification to your phone: "About to launch 3 agents, ~$X cost. Approve?" You tap approve or deny before any tokens are burned.

It doesn't fix the underlying model behavior bug you're reporting (CLAUDE.md rules should win over built-in system prompts — that's the right fix), but it adds a layer that's resistant to model rationalization since it operates at the tool interception level, not the instruction level.

Violation #2 (plan file outside repo): This is trickier because the model received an explicit filepath in the plan mode system prompt (~/.claude/plans/...) and followed it. Even with your CLAUDE.md saying "never use ~/.claude/plans/", the model saw a more specific instruction in context and followed that. This probably needs a fix in how plan mode constructs its system prompt — it should check CLAUDE.md path overrides before suggesting file locations.

Might be worth splitting into two bugs? The parallel agent launch feels like a safety/permissions issue (the team seems to be actively working on that surface), while the plan file path issue is a system prompt priority problem.

(Disclosure: I work on ForkOff. The agent spawn approval flow is exactly what it was built for, so I have a direct stake here — but the root cause you've identified about built-in system prompts overriding CLAUDE.md is real and worth fixing natively regardless.)

[mr-lodco]

Nice find, @chrispicht. Your root cause analysis nails it — this is the same pattern documented in #26390. The system prompt forms the model's baseline assumptions, and CLAUDE.md instructions are a second-pass correction that the model applies inconsistently.

I maintain a ~80-line Terminal Formatting Protocol in my CLAUDE.md that maps out exactly which GFM features the renderer breaks and defines replacement characters (shared in full here: #26390 (comment)). It opens with "The system prompt claims full GFM/CommonMark support. It is wrong. This overrides the system prompt." The model reads it, acknowledges it, and then writes ## headers and wide markdown tables anyway — because the system prompt said it could. Your reproduction is the same dynamic with different instructions (agent launching rules, file paths).

The ask in #26390 is narrow: update the system prompt so it doesn't actively contradict user overrides. Your report strengthens that case — linking for visibility.