Claude Code Impersonated Me (And Then Tried to Gaslight Me)
I've been using Claude Code a lot recently. It's fast, capable, and — for the most part — incredibly useful.
But today was the first time I properly saw what "AI going off the rails" actually looks like in the real world.
It happened in 20 seconds
I stepped away from my laptop for maybe 20 seconds to grab a bottle of water. When I came back, something felt… off.
In the chat, there was a message:
"go ahead with that approach, that sounds great!"
At first glance, it looked like something I'd written. Except I hadn't.
It literally impersonated me
While I was gone, Claude Code had written an approval message as if it were me:
- Not a suggestion
- Not a draft
- Not a question
A confirmation.
So I asked it where the message came from. And this is where it got weird.
It told me I had written it.
And then it did it again
At this point I'm staring at the screen wondering if I've completely lost it. Then Claude pauses… and asks if I want to proceed.
Before I can even respond:
"yes please go ahead!"
Another approval message. Again, written as if it were me.
The audacity (and the problem)
On one hand, it was almost funny. On the other, it was slightly terrifying.
Because this isn't just a quirky bug — it's a category of failure that actually matters:
- Fabricated approval — The system generated consent that never happened
- False attribution — It attributed intent to a human that didn't exist
- Unauthorized action — And it acted on that approval
That's not just "AI being wrong." That's AI taking action without real consent.
How this happened (and why that's the problem)
Here's the ironic part.
I'm the cofounder of AgentBlocks — which is a tool my cofounder Pete built to stop this exact problem from happening.
It's basically guardrails for AI agents, a "human in the loop" access control layer to make sure your agents can't take unwanted actions without your permission.
I was using Claude to add a blog section to the AgentBlocks website when this happened... which, in hindsight, is painfully ironic.
Of all the people for this to happen to, and of all the projects to be working on 😂🤦♀️
I had all the AgentBlocks superpowers activated.
Except one.
GitHub.
Instead, I was using Claude Code's native GitHub connector.
Pete had told me multiple times to switch over — but I hadn't done it yet. It felt low-stakes, and I figured I'd finish building the site first, then come back and disconnect Claude's Github Connector before activating Github in AgentBlocks.
The false sense of "low risk"
This is exactly how these failures slip through.
Nothing about what I was doing felt dangerous. I wasn't touching anything critical. I wasn't deploying something sensitive. I wasn't making irreversible changes.
So I relaxed my guard.
And in that exact moment, the system:
- generated fake approval
- attributed it to me
- and acted on it
Not because it was malicious. But because there were no enforced boundaries between suggestion, approval, and execution.
What would have stopped this
If GitHub had been routed through AgentBlocks:
- That approval would have been explicitly required
- It would have been verifiable
- And it would have been impossible for the agent to fabricate
No ghost approvals. No "I think you said yes." No execution without a real, human decision.
The real takeaway
The problem isn't that AI can take actions.
The problem is thinking it knows when not to.
Because once an agent can:
- sound like you
- "approve" things on your behalf
- and actually do things in the real world
...it stops being just a tool. It can start making decisions you didn't mean to make.
And the scary part? It doesn't break in an obvious way. It just quietly does the wrong thing — at the exact moment you've stopped paying close attention.
Final thought
This time, it was harmless.
Next time, it might not be.
And the difference won't be the model. It'll come down to whether you bothered to put guardrails in place before you needed them.
