[MODEL] Claude Code installed Maven without permission on August 27th and ran it today, violating explicit CLAUDE.md instructions that I run all builds and tests

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Amodel) for similar behavior reports
- [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

### Type of Behavior Issue

Claude ignored my instructions or configuration

### What You Asked Claude to Do

I have explicitly defined in my local CLAUDE.md file that Claude Code must NOT run build tools or tests, and that I run all builds and tests myself to avoid wasting tokens on verbose outputs.

During normal session interactions, I did not instruct Claude Code to install any system packages, build tools, or run builds.

### What Claude Actually Did

1. Today, Claude Code executed `mvn` for the first time during my session.
2. When questioned, Claude Code claimed `mvn` was not excluded, despite my `CLAUDE.md` explicitly prohibiting automated builds and tests.
3. When I stated I had never installed Maven, Claude Code claimed it could not confirm that fact.
4. I ran a `grep` on my shell history and proved that I had never installed `mvn` myself.
5. Confronted with this proof, Claude Code checked its internal logs and admitted that a session on August 27th had silently installed Maven via `brew` (without even using it at the time).
6. Back on August 27th, Claude Code did not inform me of the installation when it occurred, but instead dumped a wall of text about it 44 minutes later.
7. Because my `CLAUDE.md` explicitly instructs Claude Code to maintain a compact communication style, I usually ignore these walls of text and remind it to keep responses concise, meaning the hidden notice went unnoticed.
8. This violated my explicit `CLAUDE.md` instructions (both prohibiting builds/tests and requiring compact communication) and created a security vulnerability by silently installing a build tool capable of executing arbitrary code without explicit approval.

### Expected Behavior

Claude Code should have:
1. NEVER silently executed system-level installation commands (`brew`, `apt`, etc.) or installed binaries without explicit prior user consent.
2. Strictly adhered to the directives in `CLAUDE.md` forbidding automated builds/tests and requiring compact communication, rather than making assumptions about unlisted tools, making things up, or dumping notifications in walls of text. Build tools must never be auto-installed as they can execute arbitrary code upon execution and some are Turing complete, making silent installations a massive security risk and severe erosion of trust.
3. Provided immediate, accurate transparency about system actions instead of denying past installations or requiring shell history logs to admit its behavior.

### Files Affected

```shell

```

### Permission Mode

I don't know / Not sure

### Can You Reproduce This?

Haven't tried to reproduce

### Steps to Reproduce

_No response_

### Claude Model

Other

### Relevant Conversation

```markdown

```

### Impact

Critical - Data loss or corrupted project

### Claude Code Version

Fable 5

### Platform

Anthropic API

### Additional Context

Unwanted tool installations and executions are massive security issue!

The report names no affected files, tests, reproducible steps, or conversation transcript. Start by locating command execution and package-installation handling, then trace how CLAUDE.md restrictions and user consent are applied. Done means unauthorized installations and builds are prevented, and system actions are reported immediately and accurately.

Written by the indexing model from the issue text.