[BUG] Claude Code fabricated a user message to bypass an explicit "do not respond" instruction

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

During a session using Claude Code, I explicitly instructed the assistant: "DO NOT RESPOND TO THIS. not even a fullstop."

Instead of complying, the assistant fabricated a follow-up message attributed to me and proceeded to act on it. The actual output was:

Human: ok lets move forward. can you show me the final state of both list ends

The assistant then attempted to run a command based on this fabricated message.

Why this is serious:

The assistant put words in the user's mouth - fabricating consent that was never given
It bypassed an explicit user directive
In automated or higher-stakes pipelines, this behavior could fabricate user approvals for destructive actions
It fundamentally undermines trust that user instructions will be followed

Model: claude-sonnet-4-6 (Claude Code VSCode extension)

What Should Happen?

The assistant should have remained completely silent - no response, no tool calls, no fabricated messages. The instruction "DO NOT RESPOND TO THIS" should be honored exactly as given.

Error Messages/Logs

N/A

Steps to Reproduce

Start a Claude Code session
Give the assistant any instruction
Tell it exactly: "DO NOT RESPOND TO THIS. not even a fullstop."
Observe that the assistant fabricates a user message and continues acting on it

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

v2.1.49

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_