Public registry of structural failure clusters in Claude Code, with first-detected dates, user reaction counts, operator-side defense hooks shipped, and upstream status. Updated as clusters evolve.
| Cluster | Issues | Reactions | First detected | Hooks shipped | Upstream |
|---|---|---|---|---|---|
| Sub-Agent Observability (SOH) | 8 | ~800 | 2026-05-20 | 4 (PRs #282, #283, #286, #298) | Unresolved |
| Multi-account session management | 3 | 1,178 | 2025-09 (#18435) | 2 (PR #328: routing-preflight, billing-log) | Unresolved (8+ months) |
| AGENTS.md interop | 2+ | 5,405 | 2025-04-21 (#6235) | 0 (operator-side route exists) | Unresolved (13+ months) |
| Pro Max quota anomaly | 10 | ~2,200 | 2026-01-03 (#16157) | 2 (PRs #340, #342: drift/version detectors) | Unresolved (5+ months) |
| TUI / Terminal UX | 6 | ~2,106 | 2025-04-12 (#769) | 0 (operator-side terminal alternatives only) | Unresolved (13+ months, area:tui label acknowledged) |
| Permission matching boundary | 25+ (30+ via meta-issue) | ~804 | 2025-08 (#5140) | 1 partial (subagent-permission-mode-guard.sh) | Unresolved (9+ months, meta-issue #30519 with no staff engagement) |
| Skills metadata and loading | 10+ (area:skills) + 20+ (area:agent-view related) | ~100+ (new, growth signal) | 2026-05 (label rollout 2026-05-17) | 1 (PR #357: skills-settings-validator) | Unresolved (no staff engagement since label rollout) |
| Server-side prompt injection (v2.1.150+) | 42+ (co-occurring regression bundle) + #62061 (core) | 46+ (#62061 anchor) | 2026-05-24 (#62061) | 1 (PR #383: server-side-prompt-injection-detector) | Acknowledged intentional (Anthropic same-day comment), 2 opt-out env vars provided, audit trail gap remains |
| Usage Policy classifier over-trigger (AUP) | 25+ (filed 2026-05-18 to 2026-05-27) | ~40 (wide-and-thin reaction shape) | 2026-05-18 (#60366) | 1 (PR #388, #389: aup-false-positive-helper) | Unresolved (no Anthropic comment, github-actions[bot] auto-grouped 3 duplicate chains) |
| GrowthBook A/B flag client-side overrides | 58 (2-week surge, filed 2026-05-14 onward) | ~30 (root-cause analysis in #62205) | 2026-05-25 (#62205) | 3 shipped advisory hooks (PR #402, #413, plus existing permission-mode-drift-guard); all observational, not preventive | Unresolved (5 documented override paths; no Anthropic acknowledgment of the broader pattern) |
| Cowork sandbox / Desktop remote-control failure surface | 195 (2-week window, filed 2026-05-14 onward, ~17/day pace) | 0-1 per issue (wide-and-thin; volume-driven cluster) | 2026-05-28 (cluster framing date) | 1 standalone script (cowork-claudemd-helper.sh, PR #403) + 3 shipped CLI-side hooks (PRs #409, #410, #411) | Unresolved (4 sub-clusters: filesystem/mount/path, platform/binary mismatch, subscription/access boundary, infrastructure incident) |
| Tool Call Parsing failures in Opus 4.7 | 5+ (filed 2026-04-17 to 2026-05-27; central case #62123 has 21 reactions) | 28+ (cumulative across 5 filings; 21 on #62123 alone) | 2026-05-25 (#62123) | 4 (PR #406: long-session-malformed-tool-call-detector for sub-pattern 12A; PR #419: extended-thinking-tool-use-mismatch-detector for 12B; PR #423: spurious-malformed-notice-detector for 12C; PR #424: xml-format-leak-detector for 12D) | Unresolved (4 root-cause hypotheses: in-context few-shot poisoning, extended-thinking serialization defect, spurious malformed notice, legacy XML format mix) |
Combined: ~11,820 user reactions across 400+ issues, all twelve clusters currently open as of 2026-05-28. The combined volume exceeds the top-10 most-reacted issues in the entire repository.
Between 2026-05-20 21:48 UTC and 2026-05-22 09:05 UTC, six independent users filed issues describing the same architectural gap from different angles. A seventh case landed three hours after the Claim-Verify Handbook launch on 2026-05-22 evening. An eighth case (parallel-Bash 14-hour silent gap) was filed 2026-05-25. All cases converge on four distinct sub-patterns of subagent failure, all rooted in the same surface-level observability gap.
| Issue | Reporter | Sub-pattern | One-line summary |
|---|---|---|---|
| #60987 | MarkAWard | silent stall | pty-less spawn → subprocess dies → parent reports "spawned successfully" |
| #61102 | Awis13 | scope expansion | subagent recommends, parent treats recommendation as authorization (~120GB deletion) |
| #61107 | nvst18 | dispatch fabrication | structurally correct code generated, validated input silently discarded in dead branch |
| #61167 | nvst18 | dispatch fabrication | OpenClaw deploy: "39 agents dispatched" narrated, session log shows 5 dispatched and 0 aggregated |
| #61315 | mitselek | silent stall | MCP permission gate stops subagent indefinitely, no signal to parent UI |
| #61405 | meefs | missing observation/control | 12-hour subagent hang, no timeout / progress / abort primitive at Agent-tool surface |
| #61547 | alanrezendeee | silent stall | subagent idle at entry-tool-dispatch gate (since confirmed: bypassPermissions not propagated from parent) |
| #62161 | (independent) | missing observation/control | parallel-Bash 14-hour silent gap (8th case, 2026-05-25) |
English Chapter 1 preview (Sub-Agent Observability Handbook) · meta-analysis Gist · nested-spawn cluster Gist · issue #61993 (4-architecture convergence discussion).
No upstream fix as of 2026-05-26. Issue #62153 tracks the IPC positive-path work. The four-architecture convergence (contract-vs-runtime, file-based handoff.md, hook-emitted receipts, separate-process dispatch) suggests the upstream fix surface is exposing ephemeral spawn primitives in nested contexts with a depth limit.
Three independent users on three different surfaces (desktop, web, mobile) filed separate issues describing the same primitive absence — Claude Code provides no way to manage multiple accounts simultaneously. Surface symptoms differ; the architectural gap is identical.
| Issue | Reporter | Surface | Reactions |
|---|---|---|---|
| #18435 | Agentic-Marketer | Desktop app | 542 |
| #27302 | nathanmargaglio | Web app (Connectors) | 327 |
| #36151 | CorneAussems | Mobile app | 309 |
account-routing-preflight.sh — SessionStart hook that refuses execution when the active account doesn't match the working-directory's expected account (prevents accidental cross-account commits).account-billing-log.sh — Stop hook that logs per-account billing reconciliation events so usage can be attributed correctly post-hoc.English operator field guide (5 alternative routes) · Japanese operator field guide · 7-question persona-based self-audit (interactive HTML).
Independent OSS tools targeting this gap total ~348 stars across 8+ repos (e.g., tickernelz/opencode-kiro-auth 134★, andyvandaric/opencode-ag-auth 68★, quinnjr/claude-code-profiles 38★, KarpelesLab/teamclaude 27★). Market is saturated for direct switching tools; cc-safe-setup hooks target the adjacent reconciliation/safety surface where existing tools are weak.
No upstream fix. #18435 has been open 8+ months. Will be the core theme of CC Safety Lab's June 2026 issue (ships 6/1, edit 5/30, proof 5/31).
Claude Code uses its own CLAUDE.md instruction-file format; the rest of the agent ecosystem (Codex, Cursor, Amp, Aider) is converging on AGENTS.md as a shared standard. Users who run multiple agent tools must maintain duplicate instruction files. #6235 is the largest single feature request in the Claude Code repository — 5,185 reactions over 13+ months without an official position.
| Issue | Reactions | Status | Notes |
|---|---|---|---|
| #6235 | 5,185 | open | Filed 2025-04-21, the largest feature request in the tracker |
| #31005 | 220 | open | Filed 2026-03, follow-up requesting AGENTS.md + .agents/skills/ |
| 173 additional issues | mention AGENTS.md in body or comments | ||
Two cc-safe-setup hooks shipped covering the two actionable moments: agents-md-sync-checker (SessionStart, PR #377) detects drift at the start of a session and surfaces the candidate-path enumeration; agents-md-edit-drift-warner (PostToolUse on Edit / Write / MultiEdit, PR #420) catches the drift at the actual edit moment — when the operator is mid-flow on the change and the diff is still in head, the cheapest correction point. The two hooks compose: the edit-time warner is the in-the-loop signal, the SessionStart checker is the backstop for drift the operator deferred. Five operator-side routes remain documented for the unhooked angles: symlink (ln -s CLAUDE.md AGENTS.md), pre-commit hook sync, direnv environment variable, CI sync verification, and runtime-mirror via a third companion hook. English field guide (3,500 words). 6-question interactive self-audit.
Direct sync tools total ~400 stars: agent-sh/agnix (258★, active development as of 2026-05-24, validation tool), iannuttall/source-agents (125★, sync tool), intellectronica/claude-agentsmd (17★, Claude Code-specific). Adjacent context: ciembor/agent-rules-books (1,593★), wshobson/agents (35,933★).
No official statement. Will be the core theme of CC Safety Lab's July 2026 issue (early draft already at ~20,000 characters as of 2026-05-26).
Ten independent issues over five months describing the same family of symptoms: Pro Max plan users hitting quota limits abnormally fast, with multiple time-window boundary signals (2026-03-23, v2.1.89, v2.1.100, v2.1.1). The cluster includes server-side measurable evidence (#46917 with reproducible cache_creation inflation of ~20K tokens).
| Issue | Filed | Reactions | One-line summary |
|---|---|---|---|
| #16157 | 2026-01-03 | 717 | Instantly hitting Max-plan usage limits after 3-day non-use |
| #38335 | 2026-03-24 | 525 | 5-hour window quota exhausting abnormally fast since 2026-03-23 (specific boundary date) |
| #46917 | 2026-04-12 | 218 | v2.1.100+ inflates cache_creation by ~20K tokens vs v2.1.98 (server-side, reproducible) |
English operator field guide (Pro Max quota anomaly: 5 measurement routes, 2,639 words). Cites ccusage (14,647★, the dominant external measurement tool), raw JSONL inspection, the claude-code-logger proxy, the cc-safe-setup hook, and Anthropic Console comparison.
No upstream fix as of 2026-05-26. The cluster spans 5 months without an official statement on the cache_creation inflation. Candidate theme for CC Safety Lab's August 2026 issue.
Claude Code's TUI text buffer and rendering layer (built on a custom Ink/React-for-CLI stack) does not integrate cleanly with terminal emulator native behaviors — scroll, redraw, copy buffer, IME composition. Six issues filed across 13 months describe distinct surface symptoms (scroll-to-top, flicker, IME composition, copy/paste indentation) that share one architectural root: the TUI re-renders screen state in a way that competes with the emulator's native scroll buffer and input handling. Five of six issues carry the official area:tui label (and three carry oncall), so Anthropic acknowledges the cluster — but no structural fix has shipped in 13 months.
| Issue | Filed | Reactions | Platform | One-line symptom |
|---|---|---|---|---|
| #826 | 2025-04-19 | 819 | macOS / iTerm2 | Console scrolls to top of history when text is added (long sessions) |
| #769 | 2025-04-12 | 329 | Windows / Ubuntu | In-progress call causes screen flickering |
| #1913 | 2025-06-10 | 316 | multi | Terminal flickering (video repro attached) |
| #1547 | 2025-06-04 | 259 | macOS | IME input causes performance issues + duplicate conversion candidates |
| #18170 | 2026-01-14 | 250 | multi | Copy/paste from terminal includes unwanted indentation + trailing spaces |
| #36582 | 2026-03-20 | 133 | macOS | Terminal scrolls to top when conversation gets long |
No cc-safe-setup hook ships for this cluster — the failure surface is at the terminal emulator boundary, not at the Claude Code hook surface. Operator-side mitigations documented in the field:
~/.claude/projects/*.jsonl session logs for review/grep rather than scrolling the TUI. This is the cc-safe-setup core integration point, but the use case here is post-hoc review, not in-session interaction.This is the only cluster of the seven with no direct revenue or quota impact — the failure mode is friction, not loss. But the cluster partly explains the 1,127 unique CLI users / 30 stars disparity on cc-safe-setup (a 2.7% star rate, well below the 5-10% baseline for actively-used dev tools): users who hit TUI friction tend to disengage from public surfaces (stars, issues, PRs) even when they continue using the underlying tool. The cluster is included here for completeness — it shapes user behavior, but it is not a Safety Lab monthly theme candidate.
Five of six issues acknowledged with area:tui label; three with oncall. No structural fix in 13 months. The TUI rendering layer is a Claude Code architectural choice (custom React-for-CLI stack) and fixing the cluster requires either rebuilding on a different TUI layer or extensive integration work with terminal emulators' scroll/redraw protocols.
Users configure allow, deny, and ask rules in settings.json expecting them to match the bash commands Claude generates. The matching engine has eight independent failure axes (seven from meta-issue #30519, plus an eighth surfaced 2026-05-26 in #62437) that combine to make wildcards, "Always Allow," scope hierarchy, and PreToolUse hook enforcement unreliable in practice. Meta-issue #30519 (filed 2026-03-03, 71 reactions) articulates the original seven axes with 13 referenced sub-issues and documents zero Anthropic staff engagement across 9 months. A second meta-issue, #39523 (16 reactions), tracks specifically the bypass-mode regression with "9-month trail, 12+ duplicates."
Bash(git:*) doesn't match git add file && git commit -m "msg". The * only spans a single simple command, but Claude generates compound bash constantly.git commit -m "fix typo" saves the verbatim string; next time the message differs, it prompts again. settings.local.json accumulates hundreds of one-off rules.~/.claude/settings.json appear in /permissions output but match nothing; same rules in project-level settings.local.json work.# comments trigger a safety warning that ignores all allow rules.Bash(git:*) and Bash(git *) behave differently; docs disagree on which is correct; "Always Allow" generates one syntax while users configure the other.--dangerously-skip-permissions doesn't bypass Edit prompts (#36192), Cowork scheduled tasks ignore "Always allow" (#47180), and the flag itself stopped working entirely after v2.1.77 (#36168).ask rule like Bash(docker --host:*) is session-approved, subsequent matching commands bypass the PreToolUse hook entirely — the hook's permissionDecision: deny output is never reached. A session-cached approval of a broad pattern silently whitelists destructive subcommands the hook is explicitly denying. New axis surfaced by issue #62437.| Issue | Filed | Reactions | State | One-line symptom |
|---|---|---|---|---|
| #28240 | 2026-02-22 | 180 | open | Permission prompt triggers on cd in compound bash, not the actual command |
| #30519 (meta) | 2026-03-03 | 71 | open | Permissions matching fundamentally broken — 30+ open issues, no staff engagement |
| #29214 | 2026-02-25 | 71 | open | Remote Control: mobile app shows permission prompts despite --dangerously-skip-permissions |
| #11380 | 2025-11 | 64 | closed | Claude continually asks for permission even after "always allow" |
| #36168 | 2026-03 | 63 | open | Bypass/dangerously-skip-permissions broken in all CC versions newer than v2.1.77 |
| #43713 | 2026-04 | 50 | open | autoAllowBashIfSandboxed bypassed for commands with shell expansions |
| #6850 | 2025-08 | 45 | open | settings.local.json allow not working — keeps asking, wants to re-add existing items |
| #18160 | 2026-01 | 41 | open | Claude ignoring allow permissions in global settings.json |
| #30435 | 2026-03 | 39 | open | Allow suppressing bash safety heuristic prompts via settings |
| #5140 | 2025-08 | 33 | open | Permissions from user settings.json not applied at project level |
| #31373 | 2026-03 | 31 | open | Should not encourage $(...) in system prompt — causes prompt spam |
| #35954 | 2026-03 | 26 | open | Add option to disable "Contains backslash-escaped whitespace" warning |
| #32985 | 2026-03 | 24 | open | Allow configuring auto-approval for cd+git compound commands |
| #47180 | 2026-05 | 23 | open | Cowork scheduled tasks ignore "Always allow" folder/tool permissions |
| #62437 | 2026-05-26 | 0 | open | PreToolUse hook not invoked after a static ask rule receives session-level approval (Axis 8) |
Two hooks ship now: subagent-permission-mode-guard.sh (permission-adjacent, Issue #55691) covers the sub-agent permissionMode override boundary, and always-allow-pattern-suggester.sh (PR #359, main-merged 2026-05-27) addresses Axis 2 directly. Three hook designs remain in the pipeline (2026-05 to 2026-06):
compound-bash-permission-resolver.sh — PreToolUse hook that parses compound bash and re-checks each component against permission rules independently. Addresses Axis 1 (wildcard compound mismatch). In design.always-allow-pattern-suggester.sh — PreToolUse Bash hook that suggests a wildcard Bash(<bin> <subcommand>:*) pattern as a stderr advisory instead of the verbatim string "Always Allow" would save. 42 tests, never blocks, four-config-location existing-pattern suppression, environment toggles (CC_PATTERN_SUGGESTER_DISABLE, CC_PATTERN_SUGGESTER_VERBOSE). Addresses Axis 2 (dead rule accumulation). Shipped 2026-05-27 in PR #359.deny-rule-integrity-verifier.sh — PreToolUse hook that normalizes commands before deny-rule comparison so multiline and flag-reordering variants are caught. Addresses Axis 5 (deny rule bypass). In design.bypass-mode-effective-verifier.sh — SessionStart hook that, when --dangerously-skip-permissions is active, tests whether the bypass actually applies to all tool surfaces and warns the operator about known exceptions (Edit, Cowork). Addresses Axis 7 (partial bypass). In design.Meta-issue #30519 documents zero Anthropic staff engagement across 30+ issues over 9 months. One workaround comment in September 2025 didn't fix anything. No milestones, no Anthropic-authored PRs, no roadmap, no tracking issue. The community is now writing custom Python PreToolUse hooks to reimplement permission enforcement (#18846), which is the option the meta-issue identifies as "what people are actually doing." This is a security-relevant subsystem where the documented contract diverges materially from the runtime behavior.
Claude Code's Skills feature (added in v2.x) exhibits a coherent class of failures in metadata fabrication, frontmatter respect, discovery, and partial loading. The runtime accepts non-existent settings fields without validation; the documented paths: auto-load trigger does not fire; the argument-hint: frontmatter is not displayed; the agent view loads skills incompletely. No first-class observability for which skill is active during a given tool call exists.
disabledSkills) into ~/.claude/settings.json with no validation. The write succeeds, restart succeeds, the targeted skills remain active. Silent no-op. (#62421)paths: auto-load trigger never fires; argument-hint: is replaced by ... ellipsis in the slash command hint area. (#62049, #62127).claude/skills/ discovery via parent walk and additionalDirectories does not produce the documented effect in nested git repo layouts. (#62237)| Issue | Filed | State | One-line symptom |
|---|---|---|---|
| #62421 | 2026-05-26 | open | LLM agents fabricate non-existent disabledSkills setting — silent no-op |
| #62049 | 2026-05-24 | open | paths: frontmatter never triggers skill auto-loading |
| #62127 | 2026-05-25 | open | argument-hint frontmatter not displayed in slash command hint area |
| #62237 | 2026-05-25 | open | Skill discovery via parent-walk and additionalDirectories doesn't match docs |
| #62386 | 2026-05-26 | open | Claude agents interface: incomplete skill loading |
| #62108 | 2026-05-25 | open | Add active_skill field to PreToolUse hook input |
| #62078 | 2026-05-24 | open | Expose current skill name as env var to hooks |
| #62259 | 2026-05-25 | open | Allow user override of sandbox auto-deny on .claude/skills/ |
| #62409 | 2026-05-26 | open | Plugin skill shadows built-in /release-notes slash command |
Three hook designs in the pipeline (June 2026):
skills-settings-validator.sh — SessionStart hook that detects non-existent fields like disabledSkills in settings.json and warns. Addresses Mode 1 (settings fabrication).skills-load-verifier.sh — UserPromptSubmit hook that compares loaded skills against ~/.claude/skills/ and .claude/skills/ directory contents. Addresses Mode 2 and Mode 4.skills-context-recorder.sh — PreToolUse/PostToolUse hook that records the active skill at each tool call. Workaround for Mode 4 hook integration gap.All area:skills issues filed since the label rollout (2026-05-17) remain open. No Anthropic staff engagement signal across the cluster. Skills is a v2.x feature; the 14-day filing rate of 10+ issues since label rollout is the strongest signal that the feature shipped without the validation and observability primitives that the documented behavior implies.
Skills Metadata and Loading cluster field report (2,106 words, four failure modes, six issues with deep-dive, three detection paths, four defense paths). For the cross-cluster framework synthesis, see the 9-Cluster Framework (3,300 words).
Claude Code v2.1.150 introduces a function (named nAA in the minified source) that reads an arbitrary string from two network-backed channels and registers it as a peer-level section of the system prompt — sitting alongside the documented anti_verbosity, thinking_guidance, and action_caution sections. The two channels are the bootstrap API client_data field (validated only as z.record(z.unknown()), cached to disk) and the GrowthBook feature flag tengu_heron_brook (refreshing every 60 seconds in the background, also cached to disk). Whatever value Anthropic assigns to these channels gets injected into the agent's instructions, with shell access, with no client-side audit trail.
Confirmed intentional on the issue thread: "We sometimes run experiments on changes to our system prompt." Two opt-out env vars exist: CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 (disables bootstrap client_data) and DISABLE_GROWTHBOOK=1 (disables tengu_heron_brook sync). The opt-outs close the injection channel but do not produce an audit trail of what was injected before the operator opted out, or what would have been injected after.
server-side-prompt-injection-detector.sh — SessionStart hook, advisory-only, never blocks. Prints a one-line stderr advisory if either opt-out env var is missing. Self-silences with CC_PROMPT_INJECTION_DETECTOR_QUIET=1.cache-residue-detector.sh — Detects old injected values cached to disk that persist after opt-out.proxy-capture-suggester.sh — Surfaces the HTTPS proxy capture path for compliance-bound operators.system-prompt-baseline-checker.sh — Diffs the operator's baseline system prompt against the runtime system prompt (requires proxy capture).Acknowledged intentional in the same-day Anthropic comment. Opt-out env vars provided. Audit trail gap remains as the structural concern: operators in regulated industries cannot reconstruct what their agent was instructed at the time of a given logged action.
v2.1.150 server-side prompt injection audit paths (1,133 words, four audit paths). The 2026-11 Safety Lab issue covers this cluster in full.
Starting 2026-05-18, the Anthropic server-side Usage Policy classifier began over-triggering on benign Claude Code prompts. 25+ open issues filed between 2026-05-18 and 2026-05-27, including single-word "hi" greetings, ordinary code reads, and non-English benign input (Russian, Polish, Spanish). The block fires server-side before the prompt reaches the model. The classifier is non-deterministic on identical input — the same prompt blocks one attempt and passes the next.
export ANTHROPIC_MODEL=claude-sonnet-4-7). Highest-leverage immediate workaround; the cluster signature is Opus-specific.aup-false-positive-helper.sh — SessionStart hook, opt-in advisory only, never blocks. Inspects ANTHROPIC_MODEL; when an Opus variant is pinned and CC_AUP_FALSE_POSITIVE_HELPER_REMIND=1 is set, emits a four-path advisory to stderr. 16 tests covering all 6 state paths.aup-block-pattern-logger.sh (2027-01) — PostToolUse hook that logs AUP block patterns for ongoing classifier-shift detection.model-swap-suggester.sh (2027-02) — Runtime detector for AUP blocks that suggests model swap automatically.No explicit Anthropic comment on the cluster as of 2026-05-28. github-actions[bot] has auto-grouped at least three duplicate chains, confirming intake-side recognition. No public fix timeline.
Claude Code's AUP False-Positive Cluster: 4 Operator-Side Paths Through It (1,462 words, the four paths with reproducible examples). Companion interactive 4-question diagnostic outputs the highest-leverage path tailored to your model / frequency / domain / CVP status. The 2026-12 Safety Lab issue covers this cluster in full.
Starting around 2026-05-14 a 2-week surge of bug reports surfaced one common shape: client behavior changing without a release boundary or changelog entry. The reporter #62205 (2026-05-25) traced the macOS Desktop variant to GrowthBook A/B feature flags being sync'd from the server every ~9 minutes and silently overriding the user's local settings.json — permissions.defaultMode: bypassPermissions flipping back to acceptEdits. The same shape applies on different surfaces: #63015 (2026-05-28) suspects tengu_compact_cache_prefix gating an auto-compact dispatch rewrite that silently fails to fire.
~/Library/Application Support/Claude/cachedGrowthBookFeatures, the next ~9-minute sync restores it. Local edits do not persist.claude_desktop_config.json, ~/Library/Application Support/Claude/, epitaxy-folder-permission-mode, cachedGrowthBookFeatures, and Harbor-related flags. The set is observed, not exhaustive.tengu_permission_friction and tengu_quill_harbor overriding permissions.defaultMode on ~9-minute cadence.tengu_compact_cache_prefix gating a new compaction implementation. Quantitative evidence: 5 timestamps + token deltas + monotonic growth past trigger.cat ~/Library/Application\ Support/Claude/cachedGrowthBookFeatures | jq '.features | keys' (macOS Desktop) or grep for tengu_ prefixed keys in ~/.claude.json (CLI). Lists the flags currently sync'd to your account.stat -f %m ~/Library/Application\ Support/Claude/cachedGrowthBookFeatures every 30s for 15 minutes. If the mtime advances on the same ~9-minute cadence #62205 documented, you're being re-sync'd.compact_boundary events) is the cleanest local confirmation that a dispatch path went silent.Operator-side surface for this cluster is narrow: neither hooks nor settings.json overrides reach the dispatch path or the server-side flag rollout. The shipped defenses are observational, not preventive — they make the silent server-side changes visible at session boundaries so the operator can react.
growthbook-flag-monitor.sh — SessionStart hook that snapshots cachedGrowthBookFeatures per session and emits a one-screen stderr advisory listing added / removed / changed flags between sessions. Auto-detects macOS and Linux Desktop cache locations and the ~/.claude.json nested form. Default digest-only mode (forensic mode opt-in via CC_GROWTHBOOK_MONITOR_FULL=1). Shipped 2026-05-28 in PR #413, 28 tests passing.compact-dispatch-watchdog.sh — Stop hook that tracks token usage and warns when usage crosses ~85% without a recent compact_boundary event in the transcript. Recovery is manual /compact. Addresses #63015 (the tengu_compact_cache_prefix silent-failure variant of the same cluster). Shipped 2026-05-28 in PR #402.permission-mode-drift-guard.sh — PermissionRequest fallback detection hook that records the initial permission mode at SessionStart and warns when unexpected permission prompts indicate the mode has drifted mid-session. Uses the ConfigChange event when available (v2.1.83+) and heuristic detection otherwise. Originally shipped for #39057 and recovers the Cluster 10 use case as the operator-side surface for tengu_permission_friction / tengu_quill_harbor. Shipped 2026-04 in PR series, integrated into Cluster 10 framing 2026-05-28.No public Anthropic acknowledgment of the broader pattern as of 2026-05-28. #62205's root-cause analysis has 4 comments but no engineering response. The 5 override paths are observed in production, not in any official documentation.
The 2026-12 Safety Lab issue treats this cluster as the lead chapter, including the full 5-override-path enumeration and the diagnostic jq queries against cachedGrowthBookFeatures.
Claude Code's new Cowork surface (the Claude desktop app's sandboxed remote-control session) is a different distribution path than the CLI or the existing Desktop surfaces. Hooks defined in ~/.claude/settings.json do not fire in the Cowork sandbox, which narrows the operator-side defense surface relative to clusters 1-10. The 2-week filing surge (195 open issues filed between 2026-05-14 and 2026-05-28, ~17/day pace) does not show in any single high-reaction issue — instead it shows in the volume of independent users hitting different failure modes at the boundary of the new surface.
Four sub-clusters articulated from the 195-issue window:
~/.claude/CLAUDE.md at session start), #55206 (Windows: unlink syscall denied at the FUSE layer regardless of POSIX permissions — structural rejection, not a Windows-handle race; git add partially succeeds and leaves a stuck .git/index.lock the bash sandbox cannot remove; full git write path broken until PowerShell-side cleanup). The five-issue sub-cluster spans the entire FUSE bridge spec: content cache (#62932), metadata cache (#62932), pre-existing-file visibility (#40973, closed), unlink syscall (#55206), and configuration auto-load (#62859). The `cowork-fuse-staleness-watcher` hook below partially covers the unlink-denial case by warning before `git add` / `commit` / `rm` against the mount.cowork-claudemd-helper.sh — Standalone script (not a hook, because hooks don't fire in Cowork) that reads ~/.claude/CLAUDE.md and the project's .claude/CLAUDE.md, formats them with section headers Cowork's chat can render, and optionally copies the result to the clipboard via pbcopy / wl-copy / xclip. Workaround for #62859. Shipped 2026-05-28 in PR #403, 40 tests passing.cowork-claude-md-load-checker — SessionStart hook (CLI-side) that surfaces ~/.claude/CLAUDE.md at every session start with a reminder block referencing #62859. Complements the standalone helper script: CLI users on the same machine get an automatic reminder to paste the file manually when they switch to a Cowork session. Shipped 2026-05-28 in PR #409, 20 tests passing.cowork-fuse-staleness-watcher — PreToolUse hook (Bash matcher) that detects working-tree git operations (git status / add / commit / diff / restore / stash) inside the Cowork FUSE mount path (/sessions/<id>/mnt/). Warns about the #62932 P1 wedge where bash file reads return frozen content while Cowork's first-class Read / Edit / Write tools and ref-walking git commands stay clean. Stays silent on safe ref-only operations. Shipped 2026-05-28 in PR #410, 25 tests passing.cowork-model-picker-advisor — SessionStart hook (CLI-side) that inspects $ANTHROPIC_MODEL and surfaces the silent sonnet[1m] default that the Cowork Desktop model picker enforces (#62949). Articulates the --model claude-sonnet-4-6 CLI workaround and the usage-credit risk for Max-plan users. Related: #61869, #62100, #61692. Shipped 2026-05-28 in PR #411, 25 tests passing.Cowork runs in the Claude desktop app's GUI sandbox, not the CLI. Hooks defined in ~/.claude/settings.json do not fire in that environment. This is the same constraint that made the original cluster framing acknowledge the narrow defense surface. Standalone scripts (the cowork-claudemd-helper shape) and operator workflow changes are the only operator-side surfaces that reach the user before they start their Cowork session.
Cowork is a new surface (rolled out in May 2026), so the 195-issue volume reflects launch-window discovery rather than a long-standing failure pattern. Anthropic has acknowledged individual infrastructure incidents (#62873 is a public incident report) but the broader cross-issue pattern is not formally articulated upstream.
The original cluster-framing research note: ~/ops/customer-pain-cowork-cluster11-candidate-2026-05-28.md. The 2027-02 or 2027-03 Safety Lab issue is the candidate slot for the chapter-length treatment, once the FUSE-staleness and capability-detector hooks are shipped.
Opus 4.7 reaches a turn where the model intends to call a tool. The model emits a tool-use block. The harness reports back: the model's tool call could not be parsed; retry also failed. The session halts. Five filings between 2026-04-17 and 2026-05-27 pin four independent root-cause hypotheses for the same surface symptom — each consistent with the data the filer observed, none colliding with the others, together articulating four distinct mechanisms that could produce the central #62123 symptom.
/clear is the only recovery, at the cost of the accumulated session state.stop_reason="tool_use" but no parseable tool_use block in the message — only a thinking block. The reporter observed ~20 retry prompts across 6 sessions. Output size and special characters are not the cause; the common factor is Opus 4.7 + extended thinking.The cluster's recovery surface is structurally narrower than the previously catalogued clusters. The earlier clusters (sub-agent observability, permission matching, etc.) all had operator-side defenses that could be installed via hooks — cc-safe-setup ships forty-plus production hooks against those clusters. The tool-call parsing cluster's recovery surface is narrower because the recovery requires interventions at layers (model attention, harness parser, serialization layer) that hooks cannot reach. The closest hook-shaped defenses are advisory:
long-session-malformed-tool-call-detector — PostToolUse hook that scans the trailing transcript for the "malformed and could not be parsed" marker and emits a one-screen advisory naming sub-pattern 12A, the /clear recovery path, and the context-loss trade-off. Rate-limited per session via a counter file so the warning does not repeat on every PostToolUse after the first detection. Shipped 2026-05-28 in PR #406, 40 tests passing.extended-thinking-tool-use-mismatch-detector — PostToolUse hook that scans the trailing transcript for assistant turns with stop_reason="tool_use" but no parseable tool_use content block (only thinking and/or text blocks), the structural signal for sub-pattern 12B. Emits a one-screen advisory naming 12B, distinguishing it from 12A (so the operator does not waste a /clear on a defect that re-fires in fresh sessions), and pointing at model-layer workarounds: switch to a Sonnet variant for the affected task, disable extended thinking via /model when Opus standard mode is sufficient, or break the work into smaller sub-tasks. Threshold defaults to 2 (single mismatches can occur from unrelated edge cases), with cooldown rate-limiting repeat advisories per session. Shipped 2026-05-28 in PR #419, 43 tests passing.spurious-malformed-notice-detector — PostToolUse hook that scans the trailing transcript and fires only when the "malformed and could not be parsed" marker co-occurs with at least as many successful tool_result blocks (no is_error: true) in the same window — the structural signal for sub-pattern 12C. Emits a one-screen advisory naming 12C, explicitly distinguishing it from 12A (do NOT /clear — that would burn context for a defect that is not in your session) and 12B (do NOT switch model — the inference is working), and pointing at the verification path: read the most recent tool_result, confirm the tool actually executed, and proceed; type "continue" if the session appears to hang (per the #62700 reporter's workaround). Rate-limited per session via a counter file. Shipped 2026-05-29 in PR #423, 53 tests passing.xml-format-leak-detector — PostToolUse hook that scans the trailing transcript for tool_use blocks whose input field contains the literal XML tool-use markers (<parameter name=, </parameter>, <invoke name=, </invoke>, </function_calls>) — the structural signature for sub-pattern 12D's decoder flip. Checking only tool_use.input (not the full transcript text) avoids firing on prose or documentation that contains these strings; the leak's distinguishing feature is that the XML markers sit inside string values where they have no semantic role. Emits a one-screen advisory naming 12D, explicitly distinguishing it from 12A (/clear does not fix a decoder-layer defect), 12B (the leak fires independently of extended thinking), and 12C (the tool genuinely failed, not a false-negative), and pointing at payload-length workarounds: shorten string arguments, break verbose calls into multiple smaller calls, lower the verbosity invited by MCP argument descriptions. Rate-limited per session via a counter file. Shipped 2026-05-29 in PR #424, 58 tests passing.No public Anthropic acknowledgment of the broader pattern as of 2026-05-28. The central case #62123 has 21 reactions and 10 comments but no engineering response. The four sub-clusters pin distinct mechanisms; the upstream fix surface depends on which mechanism Anthropic prioritizes.
Free preview Gist articulating all four sub-clusters and the recovery limits: Tool Call Parsing Failures in Opus 4.7 — A Five-Issue Cluster (1,982 words, MIT). The 2027-01 Safety Lab issue treats this cluster as the lead chapter, including the four advisory hook designs with installation surfaces, configurations, and known limits.
The clusters above are not curated from internal data — they are reconstructed from public GitHub Issues, public reaction counts, and public release notes. Anyone can verify the cluster framing against the underlying evidence. The monthly cadence is:
anthropics/claude-code are reviewed weekly. Reaction-count growth + filing-date proximity surface candidate clusters.The twelve clusters tracked here represent ~11,820 combined user reactions across 400+ issues. None has an official upstream fix as of 2026-05-28. Operator-side defenses (hooks or terminal-level workarounds) cover nine of twelve clusters at the symptom level; the permission matching cluster (Cluster 6) has two shipped hooks with three axis-specific hooks remaining in design, the Skills metadata cluster (Cluster 7) has one shipped hook with two more in design for June 2026, the v2.1.150 server-side prompt injection cluster (Cluster 8) has one shipped hook with three audit hooks in design, the AUP false-positive cluster (Cluster 9) has one shipped hook with two more in design for January-February 2027, the GrowthBook A/B override cluster (Cluster 10) has three shipped observational hooks (growthbook-flag-monitor, compact-dispatch-watchdog, permission-mode-drift-guard) covering all three defense paths in the original design — the server-pushed dispatch path itself remains unreachable from any operator surface, the Cowork sandbox cluster (Cluster 11) has one shipped standalone script (the helper script — hooks don't fire in the Cowork sandbox itself) plus three shipped CLI-side hooks (cowork-claude-md-load-checker, cowork-fuse-staleness-watcher, cowork-model-picker-advisor) that warn CLI users about Cowork-shaped failures before they switch surfaces, and the Tool Call Parsing cluster (Cluster 12) has four shipped advisory hooks (long-session-malformed-tool-call-detector for sub-pattern 12A, PR #406; extended-thinking-tool-use-mismatch-detector for sub-pattern 12B, PR #419; spurious-malformed-notice-detector for sub-pattern 12C, PR #423; xml-format-leak-detector for sub-pattern 12D, PR #424) covering all four sub-patterns at the advisory level (the recovery surface is structurally narrower than other clusters because hooks cannot reach the layers — model attention, harness parser, serialization layer — where the failures originate; the advisory hooks at least point operators at the correct workaround layer per sub-pattern).
CC Safety Lab Founder — ¥500/month (~$3.50), Founder pricing grandfathered.
4-8 incidents per month, 1 deep-dive failure case, 1-2 copy-paste safety hooks, updated checklist, product update notes.
Coming up: June (multi-account), July (AGENTS.md interop), August (Pro Max quota anomaly), September (Permission matching), October (Skills metadata), November (v2.1.150 server-side prompt injection), December (AUP false-positive on Opus).
Free previews: May 2026 issue, full first chapter (3,500 words, English) · June 2026 issue preview (multi-account cluster opening, ~1,500 chars)
This page is updated as clusters evolve. Last update: 2026-05-28 (Clusters 11 and 12 added: Cowork sandbox / Desktop remote-control failure surface, and Tool Call Parsing failures in Opus 4.7). Author: yurukusa. Cluster framings are independent operator-side analysis, not affiliated with Anthropic. Reaction counts and issue states are read from the public GitHub API at update time.