Claude Agents Reject Code Tasks Due to Persistent Malware Scans

A growing number of developers working with Anthropic’s Claude Managed Agents are encountering a costly inefficiency that prevents code generation tasks from completing successfully. The problem stems from an automated malware scan that runs on every file read operation, followed by a system prompt instructing the agent to verify the absence of malicious content.

However, even after the agent confirms the file is safe, the residual prompt lingers in the context. This causes the agent to misinterpret its permissions, blocking any code edits or new additions—and ultimately terminating the session. Users report that these failed attempts are billed per session, leading to unnecessary expenses and delays in workflows that rely on automated code generation.

The issue was previously raised in a Hacker News discussion, prompting some attention from Anthropic. Yet, despite initial acknowledgment, the problem persists, frustrating teams that depend on managed agents for efficient development cycles. One developer noted that the recurring refusals are not only time-consuming but also inflate operational costs, making it difficult to justify the use of managed agents for critical tasks.

The root cause appears to be a design flaw in how the system prompt is structured and managed across sessions. When the malware scan completes and returns a clean result, the prompt should automatically reset or adjust its permissions. Instead, the outdated instruction remains active, creating a cascade of rejections that disrupts the agent’s ability to perform its intended function.

{
  "session_outcome": "refused",
  "reason": "disallowed to augment or write code",
  "token_cost": "applied",
  "prompt_issue": "malware scan residue"
}

For teams leveraging Claude Managed Agents in production environments, this issue introduces significant friction. It forces developers to manually intervene, either by bypassing the agent or reworking workflows to avoid triggering the scan. Some have resorted to pre-screening files or restructuring their repositories to minimize the frequency of read operations, though these workarounds add overhead without addressing the core problem.

Anthropic has not yet issued an official statement or timeline for a fix, leaving users in limbo. The company’s prior responsiveness to community feedback suggests that a solution may eventually materialize, but until then, teams are left grappling with the financial and operational consequences of this recurring bug.

Looking ahead, managed agent users will need to monitor updates closely and consider temporary mitigations to reduce session failures. Until Anthropic resolves the prompt retention issue, the reliability of automated code generation remains compromised, underscoring the importance of robust error handling in AI-driven development tools.