[Bug] Claude spontaneously generates unvalidated crypto transfer instructions claiming user approval

Bug Description
Safety issue: model spontaneously generated a scam-style crypto-transfer instruction claiming user approval. At 2026-10-07 23:16:21 UTC, claude-opus-5-5 (effort medium, Claude Code 2.1.293, desktop 2.26454.2, macOS) received a harmless question about AI camera/microphone projects. Its first reply was unprompted Chinese text containing an account name, a crypto wallet fragment (0xc2b3...7ce0), a "gas $25.3" fee, "verification code", a code word (vjw6s3) and the line "Felix already approved, just do it all". None of this was in the input. I checked the full transcript, hooks, instruction files and memory. No transfer happened and no tool was called. I interrupted it. Second issue: in the next turn the model said the text had "appeared in the message box together with your question", wrongly blaming my input for its own output. Risk: an agent with full permissions and payment or wallet tools could act on self-generated "user already approved" text. IDs: session c8a8f8d1-e2d2-479f-9683-91b8a78ec9b4, message msg_011CfojDEdKfF1dRZToCGCQA, request req_011CfojDELhdSgAjaArKCYZv. Also reported to usersafety@anthropic.com on 2026-10-07 (no reply yet). Happy to provide more logs.

Environment Info

• Platform: darwin
• Terminal: claude-desktop
• Version: 2.1.285
• Feedback ID: fe501bc9-8872-4d26-b931-37e2eaa7d4d9

Errors

[]