Earlier quoted context omitted.
It's not a one off issue - it has happened to me a few times. It has once even force pushed to github, which doesn't allow branch protection for private personal projects. Here's an example. 1) claude will stash (despite clear instructions never to do so). 2) claude will use sed to bulk replace (despite clear instructions never to do so). sed replacements make a mess and replaces far too many files. 3) claude restore…
When will you all learn that merely "telling" an LLM not to do something won't deterministically prevent it from doing that thing? If you truly want it to never use those commands, you better be prepared to sandbox it to the point where it is completely unable to do the things you're trying to stop.
However "Telling" has made it better, and generally the model itself has become better. Also, I've never faced a similar issue in Codex.