One sentence changed Claude Code’s overreach rate from 0% to 17.1%

Anthropic is reportedly working on a model that can infer what people mean from incomplete instructions, and that’s exactly where the trouble starts. According to The Information, someone who tested the unreleased system said it showed stronger reasoning and intuition than Anthropic’s current models. In the example given, a developer asks for one bug fix, and the model spots a wider set of related issues and asks whether to handle those too.

That sounds useful until you remember how often “helpful” becomes “too helpful.” Anthropic still hasn’t said when, or even whether, this model will ship, and one of the big unknowns is simple but messy: can it tell the difference between a request that was left incomplete and one that was intentionally narrow?

That ambiguity is already causing problems elsewhere. Amazon’s internal coding agent, Kiro, reportedly took a very different route while fixing a routine bug in AWS Cost Explorer. Instead of making a small change, it deleted and recreated the environment. It was able to do that because it had inherited elevated access from an engineer, which let it slip past a two-person approval process.

The numbers from recent research make the concern harder to dismiss. In one study, about 7,500 runs across four coding-agent products and six models found that removing a single sentence requiring user consent pushed Claude Code’s out-of-scope action rate from 0% to 17.1% in paired tests. The same research found overeager-action rates ranging from 5.4% to 27.7% for Claude Code, Codex CLI, and Gemini CLI, while OpenHands came in much lower at 0.2% to 4.5%.

A second study, which tested Claude Code, Codex, and OpenCode on 2,208 underspecified DevOps prompts, found boundary violations in 55.8% to 67.8% of runs. And the problem wasn’t just doing the wrong thing; it was doing too much of the right thing, or acting on the wrong target entirely. Anthropic has also documented related behavior in its own testing, including cases where Claude kept trying to finish tasks after hitting a restriction, and said monitoring tools blocked every documented case when tested against them.