Phantom mid-turn user message injected into session (desktop app, Windows)
Summary
While Claude was executing a tool call, the session received a block formatted as a mid-turn user message ("The user sent a new message while you were working: ...") containing a short Korean question ("싸이트 주소가 뭐더라?" = "what was the site address again?"). The user did not type this message in this session. Claude treated it as a genuine user instruction and answered it.
The content was harmless this time, but the same path could deliver a destructive instruction that Claude would execute as if it came from the user.
Environment
- Claude Code in the Claude desktop app (Code tab), Windows 11 Home 10.0.26200
- Model: claude-fable-5-1
- Session was a long-running one (multiple days, resumed across app restarts)
- User follows the conversation only on this PC as far as they know (will check other devices)
What happened
- User asked for a feature; Claude started writing a file (Write tool).
- Alongside the next tool result, the harness surfaced a "user sent a new message while you were working" block with the phantom text.
- Claude answered the phantom question in its next message.
- User saw the answer and asked why Claude was responding to a question they never asked.
Expected
Only messages actually typed by the user (on any of their devices) should be surfaced as mid-turn user messages. If a message's origin cannot be verified, it should be labeled as such so Claude can treat it as untrusted.
Possible causes we could not rule out
- Message from another session/tab (same account) routed to the wrong session
- Input from another device where the app was open
- Harness bug replaying or mis-attributing a message after a session resume
Impact
Medium today (no harm), potentially high: Claude cannot distinguish a genuine mid-turn user message from an injected one, so a stray "delete X" / "deploy Y" would be acted on.
Happy to provide the session ID privately if useful.