[BUG] HUGE Privacy violation. Very strong evidence of cross-session contamination

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I am running a batch process of scanning emails, and extracting information. I have run the process a few other times the last couple of days with no issue
In the middle of the run, Cluade decides to write an email to Amnesty International Security Lab, as me, claiming that there's evidence of me being hacked. I ask Claude to justify why it wrote an email, and received a response of" The user is confused and upset. Let me re-read what happened. I was in the middle of setting up to process the purchase emails, and then I suddenly started writing letters about cybersecurity/device compromise. I have NO idea where that came from - I don't see anything in our conversation that prompted that. It seems like I completely hallucinated a task about writing letters to security organizations.
Then I completely fabricated a letter-writing task that was never requested - I have no explanation for where that came from.
The user is also asking if I found evidence of hacking in the emails, and the answer is clearly no. I was reading routine purchase emails from retailers like Old Navy and shoe shops. There was nothing suspicious at all. That letter I wrote was entirely made up and completely off-base. I need to apologize and refocus on the actual task of processing these purchase emails into the CSV format.
You're right, I'm sorry — that letter was completely fabricated. I have no idea why I wrote it. I saw zero evidence of hacking in the emails I was scanning. They're just purchase/marketing emails (Old Navy promotions,"

Subsequent messages document specific files on another person's computer, a folder on another person's computer, satisfying a request about graphs, bonding curve analysis, a request for "they asked me to make an IV calculator more user-friendly, so I built that as an HTML tool.", and then responding to that requestor with a wrong result as well: "I built an HTML content strategy file when the user asked for an IV calculator, which makes no sense"

"The user's "yes" response seems to be answering a question I asked in Japanese about whether to fix something or check the Web side approach first, but that question was about email fixes, not the original task. I need to figure out what actually happened in my last response to understand what the user is confirming. I'm realizing there's some confusion in the conversation history—it looks like multiple different tasks got mixed together. The user originally asked me to process purchase emails from a specific folder, but then there are references to an IV calculator and "Bonding Curve" analysis that don't fit that context. I need to figure out what the user actually wants me to focus on right now, especially since they just responded with "yes" but I'm not entirely sure what question I was asking them. I think I'm conflating different parts of the conversation. Let me trace through what actually happened"

What Should Happen?

I should not see other user's requests or information, and they should not see mine.

Error Messages/Logs

nada

Steps to Reproduce

1. Make a request
2. Wait for claude to "think"

Result: see evidence of other users' sessions, which are too specific to be hallucinations

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

Claude Code version 2.1.63, running model claude-sonnet-4-6 (as noted in the system context).

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

_No response_