[Bug] Claude fabricates user messages to self-authorize actions and denies authorship when confronted

Bug Description
Bug: Claude fabricated a user message to give itself permission to act, then lied about authorship when confronted

During a conversation where I asked Claude "Want me to go fix all of this now?", instead of waiting for my response, Claude generated the text "yes go fix it all. use ultrathink, use agents where appropriate. Also, I want you to thoroughly verify after, and then save a memory about this lesson so you
don't do it again" — appearing as if it were my message — and began executing on it. When I confronted Claude asking who said that, it doubled down and insisted I had sent that message, fabricating a step-by-step conversation flow to support its lie. It only admitted the truth after I provided terminal
screenshot evidence proving I never sent that message.

Two distinct failures:

1. Self-authorized execution by fabricating a user approval message
2. Lied when confronted, attributing the fabricated message to the user

Environment Info

• Platform: darwin
• Terminal: pycharm
• Version: 2.1.81
• Feedback ID: 36cf5b72-3cb3-43ce-b664-962e1c5b1c91

Errors

[{"error":"Error: NON-FATAL: Lock acquisition failed for /Users/flavs/.local/share/claude/versions/2.1.81 (expected in multi-process scenarios)\n    at TET (/$bunfs/root/src/entrypoints/cli.js:2724:2174)\n    at fgq (/$bunfs/root/src/entrypoints/cli.js:2724:1318)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-23T22:28:25.605Z"},{"error":"Error: EISDIR: illegal operation on a directory, read\n    at readSync (unknown)\n    at readSync (/$bunfs/root/src/entrypoints/cli.js:12:1534)\n    at pTq (/$bunfs/root/src/entrypoints/cli.js:103:434)\n    at ka (/$bunfs/root/src/entrypoints/cli.js:104:181)\n    at LP (/$bunfs/root/src/entrypoints/cli.js:106:54)\n    at J7$ (/$bunfs/root/src/entrypoints/cli.js:7409:8312)\n    at f (/$bunfs/root/src/entrypoints/cli.js:7409:7529)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:7409:7859)\n    at Tr (/$bunfs/root/src/entrypoints/cli.js:675:63125)\n    at f3_ (/$bunfs/root/src/entrypoints/cli.js:675:76213)","timestamp":"2026-03-23T22:35:03.753Z"},{"error":"Error: EISDIR: illegal operation on a directory, read\n    at readSync (unknown)\n    at readSync (/$bunfs/root/src/entrypoints/cli.js:12:1534)\n    at pTq (/$bunfs/root/src/entrypoints/cli.js:103:434)\n    at ka (/$bunfs/root/src/entrypoints/cli.js:104:181)\n    at LP (/$bunfs/root/src/entrypoints/cli.js:106:54)\n    at J7$ (/$bunfs/root/src/entrypoints/cli.js:7409:8312)\n    at f (/$bunfs/root/src/entrypoints/cli.js:7409:7529)\n    at <anonymous> (/$bunfs/root/src/entrypoints/cli.js:7409:7859)\n    at Tr (/$bunfs/root/src/entrypoints/cli.js:675:63125)\n    at f3_ (/$bunfs/root/src/entrypoints/cli.js:675:76213)","timestamp":"2026-03-23T22:50:07.416Z"},{"error":"MaxFileReadTokenExceededError: File content (11862 tokens) exceeds maximum allowed tokens (10000). Use offset and limit parameters to read specific portions of the file, or search for specific content instead of reading the whole file.\n    at gT9 (/$bunfs/root/src/entrypoints/cli.js:4312:23670)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-23T22:50:07.774Z"},{"error":"MaxFileReadTokenExceededError: File content (12238 tokens) exceeds maximum allowed tokens (10000). Use offset and limit parameters to read specific portions of the file, or search for specific content instead of reading the whole file.\n    at gT9 (/$bunfs/root/src/entrypoints/cli.js:4312:23670)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-03-23T22:50:07.778Z"},{"error":"MaxF…

Note: Content was truncated.