[BUG] Claude Code produces false claims in technical documents, compounds errors during correction

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

it's scary on opus 4.6 that claim the best one
Claude makes claims in technical documents without reading the source code.
When asked to correct them, Claude invents new false claims that cause even more damage.
Claude trusts sub-agent output without verification, then writes it up as fact.
The correction loop produces documents that become progressively less trustworthy.

What Should Happen?

claude must verified sub-agent before write a fact

Error Messages/Logs

Steps to Reproduce

Setup:

Flutter multi-platform project with ~600 source files
Blueprint document GAP-ANALYSIS.md (~8200 lines) mapping source code to OWASP/NIST/ISO compliance standards
Each claim in the document references specific files, functions, and line numbers
Step 1 — Initial task: update GAP-ANALYSIS.md with source code verification

User asked Claude to verify whether blueprint claims match actual source code and update the document.

Step 2 — Claude delegates to sub-agents, trusts output without verification

Claude spawned Explore sub-agents to check files. Sub-agents returned mixed results (some correct, some wrong). Claude wrote all results into the document as verified facts without reading the files itself.

False claims introduced in this step:

"ProGuard/R8 shrinking (Android)" → minifyEnabled does not exist in build.gradle.kts
"Play Integrity API (Android)" → actual code is local checks only (emulator/debuggable/test-keys), not Google's Play Integrity API
"osv-scanner v2.0.3" → CI uses /releases/latest/, version is not pinned
"CI validates ≥2 pins" → CI only emits ::warning::, not a failure gate
"CsrfInterceptor" class → no such class, CSRF is inline in api_client.dart
V3.7 "lines 275-280, 478-498" → reauth_required is actually at lines 197-201, 238, 406-409
"emulator_guard (emulator detection)" → file only checks platform type (desktop vs mobile)
Step 3 — User asks Claude to re-verify ("cek lagi klaim palsu")

Claude spawned more sub-agents. Some sub-agents returned incorrect results again. Claude then "corrected" the document but introduced new false claims:

Claimed Either<Failure,T> pattern "TIDAK digunakan" (does not exist) → actually exists in 44 files as RemoteResult<T> = Either<RemoteFailure, T> in base_remote.dart:13
Claimed secureLog() function "TIDAK ADA" (does not exist) → actually exists at secure_logger.dart:24
Step 4 — User asks Claude to check again ("cek kembali semua laporan palsu")

Only at this point, when Claude read the files directly (not via sub-agents), did it discover its own corrections from Step 3 were also false. Claude then had to reverse its own reversals.

Result
After 3 rounds of "verification," the document had been edited ~30 times with a mix of correct fixes, false corrections, and reversed corrections. The document's integrity was compromised — the user cannot trust which edits are accurate without manually re-verifying every line.

Expected Behavior
Claude should read files directly before writing claims about their contents — never write "file X contains Y at line Z" without having read file X
Sub-agent output should be verified against actual files before being committed to documents
When correcting errors, Claude should not introduce new unverified claims
If Claude cannot verify a claim, it should say "unverified" rather than guess
Root Cause Analysis
Delegation without verification — Sub-agents searched for patterns but sometimes reported incorrect results (e.g., "NOT FOUND" for files that exist). Claude treated these reports as ground truth.
Confidence without evidence — Claude wrote specific line numbers (e.g., "lines 275-280") without reading those lines. The numbers were fabricated.
Compounding corrections — Each correction round introduced new unverified claims, making the document progressively less reliable.
No self-audit before commit — Claude never re-read its own edits to verify consistency before presenting them as final.
Impact
Compliance document (OWASP MASVS, NIST CSF, ISO 27001) corrupted with false technical claims
User's trust in AI-assisted documentation destroyed
Multiple hours of manual re-verification now required
Risk of false compliance posture if document is used for audits
Environment

Claude Code CLI
Model: claude-opus-4-6
OS: macOS Darwin 25.3.0
Project: Flutter multi-platform app (frontend-sso-v1)
Document: GAP-ANALYSIS.md (~8200 lines, 31 sections)

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.63 (Claude Code)

Platform

Other

Operating System

macOS

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_