Claude auto-responds to itself, acting on unapproved user messages

Bug Description

Claude Code occasionally generates a response to its own output as if the user had sent a message, when the user has not yet approved or sent anything. This results in Claude acting on content that was never confirmed by the user.

Severity

High — In one instance, Claude composed a draft message to a client and then sent it without user approval, treating its own draft as if the user had confirmed it. This happened within the last 48 hours (prior to 2026-03-29).

Reproduction

This has happened twice in 48 hours:

1. Serious incident: Claude drafted a message to a client, then auto-responded to its own draft as if the user had approved it, and sent the message without consent.

1. Minor incident (2026-03-29): User said "let's call it a night" and Claude responded immediately under the same output block — visually appearing as if Claude was talking to itself. The response was harmless but confirms the pattern is recurring.

Expected Behavior

Claude should never act on its own output as if it were user input. Every action — especially sending messages, creating PRs, posting to external services — must be explicitly triggered by a confirmed user message.

Observed Behavior

Claude's response appears merged with the user's message in the terminal (same bullet point), and in some cases Claude acts on content the user never approved.

Screenshot

The minor instance (2026-03-29) showed Claude's response rendered under the same ● bullet as the user's message, with no visual separation between user input and assistant output.

Environment

• Claude Code CLI (terminal)
• Model: Claude Opus 4.6 (1M context)
• macOS Darwin 24.6.0
• zsh shell