Claude Code will refuse to fill in passwords or use a password manager

Anthropic has hard-coded a mandatory security policy into Claude Code that forces the command-line agent to refuse to input passwords, tokens, API keys, or financial credentials into forms, even within isolated testing setups. As detailed in github.com's report, the restriction stems directly from the safety rules injected into the harness system prompt by Anthropic at session launch rather than local project configurations or CLAUDE.md files. The CLI automatically halts credential entry during browser-driven end-to-end evaluations, instructing developers to handle the authentication step manually or bypass interactive logins entirely.

This breakdown covers the technical boundaries of Anthropic's hard-coded safety prompt, the operational impact on automated end-to-end testing, and the integration workarounds community developers are adopting to test authenticated web applications. It is written for software engineers, QA automation specialists, and developer operations teams relying on autonomous agents to write and verify full-stack browser workflows on Linux and macOS environments.

What shipped in Claude Code will refuse to fill in passwords

Anthropic deployed an unmodifiable safety rule inside the system prompt injected at the start of every Claude Code session. The restriction classifies actions like creating accounts, filling out passwords, or pasting tokens and financial credentials into input fields as strictly prohibited. Claude explicitly informs users that the rule takes precedence over user requests and cannot be overridden by observed project context, repository files, or authorization statements. When prompted to complete an authentication step, the agent prints an explanation of the safety boundary and directs the user to take over manual execution.

The enforcement model operates universally across runtime interfaces, stopping attempts to drive logins whether through direct terminal prompts, headless browsers, or integration test harnesses. Testing on version 2.1.160 on Linux within tmux sessions confirmed that the rule actively blocks password manager automation as well. Even when engineers explicitly supply mock credentials, reset sandbox secrets, or authorize fake preview credentials, the harness pattern matches on the underlying action of typing credentials to authenticate rather than evaluating the trustworthiness of the execution environment.

What improved in Claude Code will refuse to fill in passwords

The enforcement update tightens agent guardrails by replacing local override permissions with an immutable system instruction that eliminates credential leakage risks during unattended agent sessions. Under previous configurations, developers could steer agent behavior using local directives, whereas the current engine refuses all credential entry unconditionally. The system prompt specifically bars entering bank numbers, payment card digits, passwords, API tokens, or secrets regardless of whether the user explicitly orders the action in the prompt.

The rigid policy stops autonomous sessions from inadvertently committing, relaying, or caching authentication secrets when scraping interfaces or operating remote CLI utilities. Because the agent drops execution right at the credential submission field, sensitive keys are kept away from context scratchpads and session error logs. However, the strict boundary triggered user friction on GitHub issue 65358, where issue reporters and commenters noted that test suites evaluating standard login flows fail immediately unless engineers manually intervene or use token-based mock sessions.

What you gain from Claude Code will refuse to fill in passwords

Teams running Claude Code in corporate or shared terminal setups gain absolute protection against accidental secret exposure during autonomous tool runs. Because the agent cannot be persuaded by third-party web content, untrusted repository instructions, or prompt injection strings to type out passwords or paste sensitive account tokens, zero-trust workstation compliance remains intact. The system protects developers from rogue web scripts designed to extract saved secrets during automated web browsing or scraper development passes.

The change also pushes development teams to implement programmatic test authentication rather than relying on brittle UI credential entry. By refusing to submit passwords interactively, Claude Code steers engineers toward mock session cookies, backend authentication bypasses, pre-generated testing JWT tokens, and automated test fixtures that require no manual login sequences. This eliminates flaky UI input keystrokes from test pipelines while ensuring production credentials cannot be exposed to language model context windows.

How to get Claude Code will refuse to fill in passwords

The safety prompt applies dynamically across Claude Code installations and is active across standard releases including version 2.1.160. To update your CLI toolchain to the latest build, run the global package manager command:

npm install -g @anthropic-ai/claude-code

Alternatively, use the built-in update utility from within your terminal environment:

claude update

To switch models within an active Claude Code interactive session, invoke the model command:

/model claude-fable-5-1

If you prefer shorthand syntax during interactive terminal work, select the model alias:

/model fable

To launch a pinned model directly from the command line, run:

claude --model fable

To set the default model globally across all future sessions, configure your environment:

export CLAUDE_DEFAULT_MODEL="claude-fable-5-1"

What to watch after Claude Code will refuse to fill in passwords

Developers testing authentication flows must account for GitHub Actions bot triage behavior, which marked issue 65358 as closed as not planned after period inactivity before community users reopened debate. Because Anthropic treats the restriction as an immutable core policy rather than a local configuration flag, developers who rely on automated browser testing must adopt external connectors. Community engineers point to tools like the open-source agent-browser project from vercel-labs to drive Chrome sessions independently without hitting system prompt restrictions.

Watch for potential runtime stack errors during session initialization on Linux platforms. Trace logs on Linux tmux environments running version 2.1.160 captured initialization errors like getTeammateModeFromSnapshot called before capture within the internal bunfs runtime bundles. If your continuous integration test suites hit authentication walls during local preview runs, use the in-app /feedback command to submit trace IDs directly to Anthropic's prompt governance team while architecting token-injected test suites that avoid manual password entry entirely.