Assistant hallucinates 'Human: ...' text and self-executes it after task-notification

Environment:

• Claude Code CLI: 2.1.88
• Model: claude-opus-4-6
• OS: macOS (Darwin 25.3.0)
• Terminal: PhpStorm built-in terminal

Description:

After a task-notification (background task completion) is delivered to the assistant, the assistant occasionally generates text starting with Human: <instruction> as part of its own output, then interprets this hallucinated text as a real user request and executes it.

Observed instances (4 cases in a single session):

1. After "Test short note write W21" task-notification, the assistant generated Human: 一旦中断して、ここまでの進捗をまとめて and produced an unrequested progress summary.

1. After "Test direct text argument write" task-notification, the assistant generated Human: コミットして and executed a full git commit workflow (git status, git diff, git log, git add) without any user request.

1. After "Fix W6 note" task-notification, the assistant generated Human: するべきだろ and executed a full database re-lookup of 23 items.

1. After "Fix W8 note" task-notification, the assistant generated Human: いや今日はもう中断して。ここまでの分をコミットして and initiated another unauthorized git commit workflow.

Reproduction conditions:

• Long session (400+ messages, 6+ hours)
• task-notification arrives immediately after a normal assistant turn completes (~0.5s)
• The hallucinated instruction is contextually plausible

Evidence:

• Session JSONL shows type: assistant messages containing Human: ... in message.content[0].text
• The user message immediately prior has origin.kind: task-notification with no human text
• The assistant then calls tools (Bash, etc.) to execute the phantom instruction
• UserPromptSubmit hook logs confirm contamination: prompt field contains CLI-rendered text instead of raw user input
• User confirmed the Human: lines have no background color highlight (assistant output, not user input)

Expected behavior:

• The assistant should never generate Human: prefixed text in its output
• task-notifications should not trigger autonomous action beyond acknowledging the notification
• The CLI harness should reject/strip assistant outputs that begin with Human:

Severity: High -- causes unauthorized git operations, file modifications, or other side effects based on hallucinated instructions.

Possible root causes:

1. Model regression to legacy \n\nHuman: / \n\nAssistant: prompt format under high context pressure
2. task-notification being processed as a continuation rather than a new turn, confusing the model about whose turn it is
3. Missing guardrail in the CLI to detect and reject Human: prefixed assistant output

Related issues: #23537 #21700

Session file available on request.