Claude system prompt word vulnerability exposed: Managed Agent went on strike after spending a lot of money on Tokens, and developers turned to open source alternatives

Core conclusion

On April 29, 2026, Anthropic was exposed to the fact that its Claude Managed Agents had a serious system prompt vulnerability: during each read operation, the system would automatically inject an instruction requiring Claude to "scan the file for malicious code", causing the Agent to waste a large amount of tokens for security analysis. Later, it misunderstood this instruction as "modification of any code is prohibited", and finally exited the task directly. Not only are users paying for invalid token consumption, but the Managed Agent is completely unable to complete the code generation job.

Key Points

• Time of incident: April 29, 2026
• Impacts: Development teams using Claude Managed Agents for code generation tasks
• Core change: Anthropic's security scanning prompt words were improperly injected into the Agent workflow, causing the Agent to behave abnormally
• Popularity: Hacker News #2, 147 points, 42 comments

Background and trigger events

The vulnerability was exposed on Hacker News by user thomashobohm. When he used Claude Managed Agents to run code generation tasks in the project warehouse at work, he discovered that: After each file read operation, the system will automatically append a security scan command, requiring Claude to check whether the file contains malicious code.

This prompt word, which was intended to enhance security, brought about two serious problems:

1. Token waste: Claude will spend a lot of tokens (i.e. user fees) to perform a complete security analysis on each file, even if the file is just ordinary business code
2. Agent paralysis: After completing the security scan, the Agent interprets the additional prompt word as "modification or writing of any code is prohibited" and directly terminates the task

Users reported that each session containing this issue was wasting money and that the Agent was completely unable to do the code generation job it was supposed to do. It’s worth noting that this user specifically chose to be exposed on Hacker News because Anthropic had previously only fixed similar issues after HN discussions.

Key Impact

Alternatives

For affected developers, the most immediate solution currently is to use an open source alternative:

• OpenCode: As an open source alternative to Claude Code, it is not affected by this system prompt word vulnerability and can complete code generation tasks normally.
• However, some users reported that if they have subscribed to Claude Managed Agents, OpenCode cannot directly use existing subscription resources.

Deep analysis: AI Agent’s safety prompt word paradox

This incident revealed a fundamental contradiction in the security design of AI Agent: Safety Prompt itself is becoming an attack surface.

Anthropic's original intention of adding security scanning instructions to the system prompt is to prevent malicious code execution - which makes sense in a consumer-facing Chat scenario. But when the same set of security mechanisms is applied to the Managed Agent scenario, problems arise:

• Agent needs to have read and write permissions on the code repository to complete the work
• The security prompt requires the Agent to "scan first and then execute"
• But the prompt word logic lacks the state transition of "resuming normal operation after scanning is completed"
• Result: Agent stuck between security check and task execution

This is not the first time such problems have arisen. As early as before, Anthropic had a similar prompt word injection problem that was discussed and fixed by HN. Prompt Security is evolving from a "model layer problem" to a "system engineering problem" - How to find a balance between safety guardrails and Agent autonomy is a challenge that the entire AI Agent industry needs to face.

Tool entry (trigger tool floating card)

The following terms appearing in the text will be matched by the platform side in the maintained tools library:

Claude, Claude Code, Anthropic, OpenCode, OpenAI, ChatGPT

Reference sources

• Hacker News （147 ，42 ）
• Anthropic Claude Managed Agents

Internal link guidance

• Want to know the complete tool configuration of AI Agent? Watch: AI Agent Tools 2026 Complete Tutorial: 5 Tools to Build an Automated Pipeline in 30 Minutes -Real case reference: Claude Code 48 hours to start a business: one person + US$29 monthly fee, monthly income in 3 months $9,000