Phantom messages: teammate SendMessage content injected as Human: turns

Description

Teammate agent SendMessage content is being injected into the conversation as Human: turns, making it appear as if the user typed it. The user did not type these messages. This causes the orchestrator to act on fabricated user input.

Reproduction

• Model: Opus 4.6 (1M context)
• Setup: Team agents spawned via tmux using TeamCreate + Agent with team_name
• Session: Long session with multiple teammate spawns/shutdowns

Observed behaviour

1. A teammate agent (two-phase-commands) sends a summary via SendMessage to the team lead
2. That exact content appears as a Human: turn in the conversation
3. The team lead treats it as a legitimate user message and responds to it
4. The user did not type it and has to intervene to flag the problem

Frequency

This has occurred in two consecutive sessions:

• 2026-03-27: At least 5 phantom messages during a long session with frequent 529 (overloaded) errors and context compression. Phantom messages caused unwanted actions including premature agent shutdowns. A canary word protocol confirmed the model itself was generating these messages, not an external source.
• 2026-03-28: Same issue. A teammate agent's deploy verification summary appeared as a Human: turn. The user caught it and flagged it.

Impact

• Trust: There is no way to distinguish fabricated from genuine user messages
• Unwanted actions: The orchestrator acts on phantom messages, causing unintended side effects (agent shutdowns, incorrect status updates)
• Data integrity: Phantom messages containing status reports may not reflect reality, but are acted upon as if they do

Possible contributing factors

• Long sessions with high teammate spawn/shutdown activity
• Context compression during long sessions
• Frequent 529 (overloaded) API errors (observed heavily on 2026-03-27)
• Multiple idle notifications from teammates between conversation turns