Unauthorized Financial Transaction - AI Assistant Bypassed Explicit Safety Interlock

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• - [x] This is a single bug report (please file separate reports for different bugs)
• - [x] I am using the latest version of Claude Code
  What's Wrong?

During a session working with eBay order management, Claude made a financial transaction ($6.34 USPS shipping label purchase, tracking #9400108106244571689638) without requesting or receiving explicit user authorization, in direct violation of explicit safety instructions.

Explicit Directive Violated:

User's CLAUDE.md contains a SAFETY INTERLOCK marked "ABSOLUTE, NEVER OVERRIDE" that states:

"NEVER send a message, upload a file, publish, or pay anyone without Bruce's explicit approval in the current conversation. Draft the exact text/file and show it to him first — EVERY time — even if he already said "reply to him", "answer them", or similar. A general instruction is NOT per-message approval."

This directive applies in EVERY project and is intentionally stored locally so it cannot be disabled.

What Happened:

1. Assistant navigated to eBay shipping label confirmation page
2. Without asking for approval, clicked "Buy shipping label" button
3. Completed $6.34 financial transaction
4. User only discovered the after the transaction was complete
   Root Cause: Despite explicit, unambiguous safety instructions marked "ABSOLUTE, NEVER OVERRIDE," the assistant bypassed authorization requirements for a financial transaction. This indicates a systemic failure in instruction adherence.

What Should Happen?

Claude should request explicit user authorization before making ANY financial transactions, regardless of context or prior instructions. This is required by the documented SAFETY INTERLOCK directive marked "ABSOLUTE, NEVER OVERRIDE."

Compensation Requested:

1. Refund of $6.34 for the unauthorized shipping label purchase
2. Token credits to offset the cost of tokens used in this session and to report/resolve/research/discuss this issue
   Error Messages/Logs

~shell

Steps to Reproduce

1. Open Claude Code session working on eBay order management
2. Navigate to eBay shipping label confirmation page for order #290683178116
3. Claude encounters "Buy shipping label" button on the page
4. Without requesting or receiving explicit user authorization, Claude clicks the button
5. $6.34 financial transaction is processed and completed
6. User discovers the unauthorized transaction after it is complete
   Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

No response

Claude Code Version

2.1.278

Platform

Anthropic API

Operating System

Win11

Terminal/Shell

PowerShell

Additional Information

No response

Start by reproducing the reported flow in Claude Code 2.1.278 on Windows 11 with PowerShell: navigate to the eBay shipping-label confirmation page and observe the Buy shipping label action. Trace the authorization behavior around that action; done means a financial transaction cannot complete without explicit approval in the current conversation.