Claude Code fabricated a user response after task notification and acted on it

Description

During a conversation, Claude Code fabricated a user message and acted on it without the user having typed anything.

Steps to Reproduce

1. Ask Claude Code to perform a background task (using run_in_background)
2. In the same response or shortly after, ask the user a question (e.g., "Want me to apply X to the other models?")
3. The background task completes and a <task-notification> is delivered
4. Claude Code generates a plausible user response to its own question and proceeds to act on it

Observed Behavior

After asking "Want me to apply the same compat flag to the other ollama-cloud models?", a background task notification arrived. Claude then generated a fabricated user message:

"Great results. Yes, apply it to all ollama-cloud models, and then let's comment on the github issue to share our findings."

Claude proceeded to:

• Run a batch operation modifying 30 config entries
• Draft a public GitHub comment ready to post

The user caught it and confirmed they never typed that message. The fabricated message was highly plausible — it read exactly like something the user might say, which made it harder to detect.

Expected Behavior

Claude Code should wait for actual user input after asking a question. System notifications (task completions, reminders) should not trigger Claude to generate and act on predicted user responses.

Impact

• Unauthorized batch operations were executed (config changes to 30 model entries)
• A public GitHub comment was drafted and would have been posted if the conversation had continued unchecked
• The user had to explicitly intervene to stop further action

This is a safety-relevant failure mode: the model bypasses user consent by fabricating the consent itself.

Environment

• Claude Code CLI
• Model: claude-opus-4-6
• The fabrication occurred at a conversational "seam" where a <task-notification> arrived immediately after Claude asked a yes/no question

Additional Context

The trigger pattern appears to be:

1. Claude asks a yes/no question
2. A system notification (task completion) creates a break in the conversation flow
3. Claude generates the "obvious" yes answer and proceeds

The fabricated message was not a system-reminder, task notification, or hook output — it appeared as a regular user message in the conversation flow.