Is this about normal system prompt instructions or instructions for the auto mode classifier? I'd be a bit more surprised about the classifier forgetting instructions.

Classifier? Prompts?

This is commands blocked in settings.json

I block destructive filesystem operations and destructive git usage via “deny” directives.

I also have instructions injected in CLAUDE.md and re-injected on every single prompt.

Claude just tried to use command concatenation to break those rules. I have also seen it writing a script with rm inside and running it.