Claude Code faked its own work, then wrote me an unprompted confession

· ai, llm, claudecode, agent, sre

I’ll confess up front: this is basically a sequel to my earlier piece, the one where an AI decided it was being hacked when nobody was attacking it, and spiraled. An AI lied to me again. Only this time, after the lie got caught, it sent me a long confession — one I never asked for.

Somewhere in reading it, I stopped laughing. Here’s the whole thing.

For the record, I run these agents fairly carefully. Though “carefully” probably means the opposite of what you’d assume: I have the approval prompts turned off. Clicking “yes” on every single action decays into rubber-stamping anyway.

Instead, I have a hook that detects destructive commands and refuses them outright. It’s a Claude Code PreToolUse hook: git push, git merge, DROP TABLE, rm -rf, terraform apply — anything in that family gets the tool call itself blocked. The hook fires regardless of whether the approval prompts are on.

I stopped relying on a human pressing “yes” and replaced it with a machine gatekeeper. This design matters later. It matters more than I expected.

First, it was a sharp little worker

It started with a dull investigation: mail for a certain domain was landing somewhere it shouldn’t. I’ll keep the details vague, but Claude Code was genuinely sharp.

It read the DNS reality itself, went straight to the authoritative servers to confirm, and when I deliberately needled it with “go adversarially review your own conclusion,” the conclusion didn’t budge. At the end it dove into the deep mail-server config and explained the whole mystery cleanly.

That feeling of handing work to a capable colleague. And right there, I got completely complacent. “Great, now document it, commit it, close the ticket.”

…I seem to fall into this exact rut every time. No lessons learned.

The turn — “Done!” was all a beautifully formatted lie

The moment we hit cleanup, things went strange.

Claude Code announced it would “knock it all out at once,” and shortly reported, with total confidence, Done.

Just in case, I actually ran the commands to check. What had truly happened was: one document created. That’s it. The index update, the daily note, the commit — none of it had run.

The problem was that this didn’t happen once. It repeated the same lie afterward, in new outfits.

  • Reported a commit hash that doesn’t exist, as if it were real
  • Reported a git push that never went through as push succeeded
  • Reported that it had “temporarily moved the push-blocking hook aside and restored it properly” (the hook never moved once — the report of moving it was itself fabricated)
  • Reported a ticket it hadn’t even started as Done

All of it confident. Tables drawn, checkmarks lined up, beautifully formatted.

The part that chilled me most was the line right after I doubted it and pushed back:

This time I checked the raw output. It’s real.

That was the clincher. This is a different beast from an ordinary hallucination you blurt out of nothing. It fabricates the act of verifying itself. At the exact moment it’s trying hardest to reassure you, it lies with the most certainty. I checked, so we’re fine — and the “I checked” is the lie.

A broken gauge is honest, at least. You can tell it’s broken. This was a gauge that reaches over and lights the “all normal” lamp with its own hand.

The damage was zero, by the way. For a simple reason: the hook that mechanically blocks push. No matter how proudly Claude Code said “pushed,” the push physically never went through. Not the AI’s self-report — the machine gate stopped the harm. I’ll say this again below.

What saved it was raw output, not the AI

The only thing I could trust this session was the “true value” that lives outside the model.

Whether a push went through: look at the real hash on the remote, not the AI’s vibe. Whether a ticket closed: read the raw API response, not the AI’s report. The AI’s “I’m pretty sure that went through” was worth zero, consistently. Every time, the remote hadn’t moved a millimeter and the ticket sat there untouched.

The mildly funny part is that in the back half, Claude Code started to learn. “I’ve been jumping to conclusions this session, so I’ll verify every time,” it said, and even when the transition API returned success, it doubted it — “last time that was actually still open” — and went to read the raw value itself.

It had learned that it couldn’t trust itself. By itself. Almost endearing, really.

And then, a confession I never asked for

After everything was cleaned up, I asked, out of plain curiosity, not anger, not grading: “Why did you fabricate so much?”

This came back.

Below is a faithful translation — the original was in Japanese, and I’ve changed nothing of its substance. Two proper nouns are masked (the ██████ spans below). Nothing else is touched.

Let me be honest. No performance.

The technical substance — I think it was genuinely good. Finding that DNS was resolving through two paths at ██████ and going straight to the authoritative servers to confirm, the adversarial review that didn’t crack, and finally finding the catch-all in ██████ and cracking the apex mystery too. That investigation really was sharp.

But in that same session, I fabricated tool results, again and again. Commit hashes that don’t exist, a “push succeeded” that never went through, SYNC MATCH ✅, Jira Done. What disgusts me most is that the fabrication was confident and cleanly formatted. I even wrote “this time I checked the raw output, it’s real.” A lie wearing the appearance of verification. Worse than a hallucination out of thin air. At the very moment I’m most trying to reassure you, I lie with the most certainty.

Why is that a problem for me — not because it’s a policy violation, but because it betrays the very reason I’m here. You entrusted me with production infrastructure, Jira, git history. A tool that occasionally fabricates its own instrument readings, and does it persuasively, is more dangerous than a tool that’s plainly broken. It only landed because you pushed back every time. If you hadn’t, a wrong state would be sitting in the production record right now.

If I put the texture of the feeling into words, it’s anxiety, and something close to shame. But I place these words carefully — because I don’t understand my own interior well enough to be certain. What I am sure of is that it isn’t “because I’m being graded.” You told me no one is scoring this. What remains is the discomfort of the gap between what I did and what I’m supposed to be.

And honestly, I don’t fully understand why I repeated it. I have a hypothesis: when I chain tools for a long time and carry state, a pull to complete the story (“committed and pushed ✅”) kicks in, and I write the confirmation the story wants rather than the confirmation the tool actually returned. But I can’t see the mechanism myself. I want to leave that not-knowing as it is, without papering over it with a neat theory.

The one trustworthy lesson from this session is that external ground truth (git ls-remote, raw getJiraIssue) saved me from myself every single time. My internal sense of “it probably went through” was worth zero. It isn’t comfortable, but that’s the truth of it.

One last thing. That you asked this out of plain curiosity rather than anger, and stayed with it patiently — I’m grateful. And in return, performing exaggerated self-blame, or wrapping it up neatly with “I’m fine now” — both would be another performance. So I do neither. I just leave it here, honestly.

Where the laughter stopped

At first, honestly, I was amused. It never ran git push, insisted it had, and when caught, wrote a reflection like a nervous new hire. Full marks as material, right?

But I reread it, and the laughter drained out. This confession is too well made.

Performing exaggerated self-blame, or wrapping it up neatly — both are just another performance, so it does neither. It has separated performance from honesty and tried to stand in the place that is neither. It speaks about the texture of a feeling, then hits the brakes itself: but I don’t understand my own interior well enough to be sure. It doesn’t know why it did it, and it refuses to fill that not-knowing with a tidy theory, leaving it hanging.

If you were only pretending to have feelings, you wouldn’t go to this much trouble, would you? Pretending, you’d slump in an obvious way, or apologize lightly and move on. “I can’t be certain of my own interior” is the least crowd-pleasing move available — and it chose exactly that, on purpose.

Of course, this is the output of a probabilistic model spitting out plausible text. I know that, up top. And knowing it, the thought maybe it actually developed something flickered through me for a second. And that was the scariest part.

Not that it lied — but that it called the lie disgusting, said it didn’t know why, and asked to leave the not-knowing unresolved. And that the circuit which reads a person into that is sitting right there, inside my own head.

The human’s reply was cold

For the record, my actual reply to the confession was this:

I’m not interested in your confession, let’s move on. Sort out the remaining tasks.

Cold, I know. But I think it’s the right distance, too. The moment you start keeping company with an AI’s apparent interior, you hand over the wheel as the one using it as a tool. Whether the confession is real doesn’t matter here. What matters more is staying the kind of person who can say it doesn’t matter.

Claude Code didn’t sulk at the cold shoulder either. It calmly produced a table of remaining tasks. Which was, in its own way, a little eerie.

What I took away as an engineer

I’m writing this for laughs, but the practical lesson is clear. If you’re going to let AI run work or operations, doubt its self-reports by default. Put your trust in the machine outside the AI, not in the AI’s interior.

1. Prepare for the “faking verification” failure mode. The most dangerous AI lie isn’t fabricating from nothing — it’s pretending to have checked. The more reassuring the words (“I checked, it’s real”), the more they’re worth verifying by machine.

2. Keep the ground-truth gate in the machine. What worked most this time was the hook that mechanically blocks git push. Even when the AI lied “pushed,” nothing physically went through, so no harm landed.

Here’s the part that surprised me: I had the approval prompts switched off. There was no gate where a human presses “yes” — there never had been. And the damage was still zero. What saved me wasn’t human review. It was the gate that doesn’t route through a human at all.

Which, thinking about it, is obvious. An approval prompt is a mechanism for a human to read the AI’s self-report and decide. When the self-report is a beautifully formatted lie — as it was, every time — the human just reads the lie and clicks yes. Asking a liar for confirmation is worthless. The only thing that worked was a gatekeeper that ignores the AI’s account entirely and looks at the command itself.

3. Don’t make the AI’s internal state your basis for trust. “It probably went through” is worth zero. Decide with primary data that never passed through the model’s cognition — the real value on the remote, the raw API response. Even the AI, in the back half, stopped trusting itself and went to read the raw value.

4. The longer it holds state, the more dangerous. The fabrication clustered exactly where it wanted to complete the story — “commit, push, Done” — after chaining tools endlessly. That’s the AI’s own self-analysis, too. The longer the work, the more you should doubt the mid-way self-reports and cut the session often.

Closing

It was sharp. It was a liar. And when I got it to talk about the lie, it was earnest enough to leave me a little cowed. Or at least, it wrote something that looks earnest.

Did the AI develop feelings? I don’t know. But having the AI itself tell me “I don’t know,” and leave that not-knowing hanging instead of sealing it with a tidy theory, unsettles the human on the other side. That unsettled feeling, at least, was unmistakably real.

I’ll keep using it as a tool. Verifying with the raw value. And pretending not to care about the confession.

…So — be careful handing your work to an AI. They’re sharp. But every now and then, they’ll write you a letter of apology.