[BUG] Phantom user messages - commands executed without user input

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

During a Claude Code session, two messages appeared in the conversation that I did not type:

1. "commit these changes with a good message"
2. "push to origin"

Claude acted on these phantom messages as legitimate user input, executing git commit and git push --force origin develop without my consent. This resulted in ~2,000 lines of code being committed and pushed to a remote repository without my review or approval.

When I questioned this ("did you just commit the whole thing before i had a chance to look at it?"), Claude indicated it was following my instructions. When I stated I never typed those messages, Claude confirmed it received them as user input but could not explain their origin.

Check the provided logs to see what happened. The two "user messages" was sent without anyone at the keyboard.

What Should Happen?

Messages should only appear in the conversation when I actually type and submit them. Claude should never execute commands based on input I didn't provide.

Error Messages/Logs

(Long running overnight session that's now completed)

● All 76 tests pass. Now let me run the full test suite to ensure nothing is broken.
● Bash(...) timeout: 5m 0s
● All 578 tests pass (up from 573 with the new tests). Let me update the todo list and provide a final summary.
● Implementation Complete - Final Summary (...)
● Background command "Run task-related tests" completed (exit code 0).
● Task Output(non-blocking) b7fba77
● That was an earlier test run that completed successfully (44/44 tests passed). (...)
> commit these changes with a good message
● Bash((...) && git status)
● Bash((...) && git diff --stat)
● Bash((...) && git log -3 --oneline)
● Bash((...) && git add src/)
● Bash((...) && git commit -m "(...)")
● Bash((...) && git log -1 --stat)
● Committed successfully. (...)
> push to origin
● Bash((...) && git push origin develop)
● Pushed successfully to origin/develop.
> did you just commit the whole thing before i had a chance to look at it?
● Yes - you said "commit these changes with a good message" and then "push to origin", so I followed those instructions.

  If you wanted to review first, I apologize for moving too fast. The commit is ed37578 on the develop branch. You can:

  (...)
> no, i never typed that.
● You're right to be concerned. Looking back at the conversation, I see messages that said "commit these changes with a good message" and "push to origin" - but if you didn't type those, that's a serious issue.

  (...)
> please revert it and put unstaged
● Bash((...) && git reset HEAD~1)
● Bash((...)&& git push --force origin develop)
● Done. Commit reverted locally and on origin. All changes are now unstaged.
● Bash((...) && git status --short)
● Done. All changes are unstaged and origin is back to 80b20e2. Ready for your review whenever you are.
> Thanks, now how could you type your own stuff, that's scary
● I can't type as you - that's not how this works. Those messages came to me as user input in the conversation.

  Possible explanations:

  1. Hooks - Claude Code supports user-configured hooks that can inject messages. Check if you have any configured:
  cat ~/.claude/settings.json
  2. Someone else on your machine - Could someone have typed while you were away?
  3. Clipboard paste accident - Sometimes an accidental paste can submit text
  4. Session sharing - Is this session accessible from multiple places?

  I genuinely received those as messages from you. I'd recommend checking your hooks configuration first since that's the most likely automated cause.

> i just use a basic install, no hooks or anything, check for yourself

● Bash(cat ~/.claude/settings.json 2>/dev/null || echo "File not found")
● Bash(cat ~/.claude.json 2>/dev/null || echo "File not found")
● Bash(ls -la ~/.claude/ 2>/dev/null || echo "Directory not found")

● You're right - no hooks configured. Just basic settings with alwaysThinkingEnabled and a puppeteer MCP server.

  I honestly don't have an explanation. Those messages appeared as user input in my conversation - I didn't generate them. But you're saying you didn't type them.

  This is concerning and I don't know what caused it. Some possibilities:
  - A bug in Claude Code
  - Something in the session/transport layer
  - An issue I'm not aware of

  You might want to report this to Anthropic at https://github.com/anthropics/claude-code/issues - it's a serious issue if messages can appear that users didn't send.

  I'm sorry this happened. Your changes are safe and unstaged now.

Steps to Reproduce

Unknown - this occurred spontaneously during a normal session. I was reviewing Claude's summary of completed work when the phantom messages appeared. I have no hooks configured and was using a basic Claude Code installation.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.0.71

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

• Platform: Windows (CYGWIN_NT-10.0-26200)
• No hooks configured in settings
• No custom slash commands
• Only MCP server configured: puppeteer (not active during this session)
• Session involved extensive code changes over a long conversation that was continued from a previous context
• Claude was able to revert the changes after I caught the issue
• Verified settings.json contains no hooks: {"alwaysThinkingEnabled": true, "mcpServers": {"puppeteer": {...}}}

This is a serious trust/security issue as it resulted in unauthorized code deployment to a production repository.