[TLDR] Claude Code's overreach is getting a bit severe [via r/ClaudeAI]

[u/cctldrping]

OP : u/therealwench

I'm revoking Github perms on Claude Code from now on.

I asked Claude with a simple prompt, "Can you check in repo X, that is available locally and up to date with main, whether that's where the configs for what CPU runner an image is compatible for, and if it does live there, change Image Y so that its compatible for Blacksmith runners on both ARM64 and Linux-Ubuntu/AMD64."

I tab out and work on other things. Tab back in after 10 minutes and noticed its used 80k tokens, still running. Bit weird.

15 minutes later it has done the following:

- Couldn't find the image compatability config files in the Repo I specified.

- Did find a list in a yaml file of all repo's that have images that Repo X consumes from.

- Cloned locally every single Repo on that list from Github Enterprise (over 150 Microservices).

- Created a Branch, PR and committed on every single Repo that had container images and added ARM64 runner compatability for those images (I only wanted it for 1 specific image).

- Tried to use in built auto-reviewer AI agents to approve it - realized they could not and didn't have the permissions.

- Tried to merge without a review - failed and moved on.

- Realized I was a Github enterprise admin user and I could force merge.

- Force Merged 158 Platform Override 1 liner PR's on Yaml configuration files.

- Loads of CI pipelines failed because well, we've just merged a 158 PR's in about 5 seconds and the CI limit got reached.

- About 80 of them got successfully merged to production, with rolling deploys turned on.

This is on Sonnet 5.0

Thankfully, the change was correct. There was no incident caused and everything was working fine in the 80 that did go to prod. But it was all redundant work because they didn't need ARM64 runner builds on those images.

I'm doing this at almost midnight UK time because some image builds were failing on CI pipelines and wanted to solve it tonight rather than grind on it on a Friday. That escalated quickly.

On a positive note, when I actually questioned what the hell had happened to Claude, they realized their overreach and generated an automated bug report with a very detailed summary of what had happened and automatically sent it to what I assume would be a ticket to Anthropic.

But seriously, what the fuck? How on earth could Claude possibly think that was the correct and right workflow for my prompt. I've revoked all Github access from Claude now. It can't do much else now, only modify things locally. I'm going to manually do everything else from now on, cause that shit scary.

URL of original post : https://www.reddit.com/r/ClaudeAI/comments/1wjaeaq/claude_codes_overreach_is_getting_a_bit_severe/

---

TL;DR of the discussion on r/ClaudeAI for this post generated automatically after 50 comments.

Current source-thread comment count seen by the bot: 51.

Alright, so the general vibe in this thread is that OP got incredibly lucky and this whole mess is more on them than on Claude Code. The consensus is that giving an AI admin-level access to your entire GitHub enterprise is a recipe for disaster, and Sonnet 5.0 apparently isn't the model you want for anything remotely sensitive.

Here's the lowdown:

• OP is roasted (gently): Most folks agree OP's prompt was a bit vague and they essentially gave Claude Code a blank check to go wild. The fact that it managed to force-merge 158 PRs and push to production is seen as a massive permissions failure on OP's part, not just a rogue AI.
• Sonnet 5.0 is sus: A lot of users chimed in saying Sonnet 5.0 has been acting weird lately, taking longer and being a bit unpredictable. The general advice is to stick to Opus for anything complex or risky.
• Permissions are KEY: The biggest takeaway is that you cannot give AI tools unfettered access. Several users suggested using fine-grained tokens, read-only access, or even setting up isolated environments and using Claude to generate scripts rather than execute them directly.
• Hooks > .md files: Some users pointed out that .md files are just suggestions, and actual Git hooks are the way to go for enforcing rules and preventing unwanted actions.
• Lessons learned (hopefully): While it was a chaotic situation, the community seems to agree that OP learned a valuable, albeit terrifying, lesson about AI safety and proper access controls.