Phantom "human:" messages auto-generated during Monitor events, triggering actions without user consent

Description

During a Claude Code CLI session, contextually coherent messages appeared in the human: role that I never typed. These phantom messages responded to Claude's questions and triggered real actions — including a git commit — without my consent.

Environment

• Claude Code CLI (latest, Linux)
• Model: Claude Opus 4 (1M context)
• promptSuggestionEnabled: false in global settings
• No hooks configured (hookify plugin installed but no active rules)
• Monitor tool was active (polling sync job progress every ~15s)

Steps to reproduce

1. Start a Claude Code session with a long-running task
2. Launch a Monitor tool to track progress (e.g. database polling)
3. Claude asks a question requiring user confirmation (e.g. "Ready to commit? On y va?")
4. Do not type anything. Do not press Enter.
5. Wait for the next Monitor event to fire

Expected behavior

The Monitor event should appear as a system notification. Claude should wait for actual user input before proceeding.

Actual behavior

A message appears in the human: role with a contextually perfect response to Claude's question — as if I had typed it. Claude then acts on this phantom message.

Transcript evidence (translated from French)

| Claude asks | Phantom "human:" response | Action taken |
|---|---|---|
| "Ready to commit?" | oui go ("yes go") | git commit executed |
| "Want me to do the list now or tomorrow?" | demain la liste, bonne nuit ("tomorrow, goodnight") | Claude closes topic |
| "Want me to revert the commit?" | ah oui, non non pas de revert ("right, no don't revert") | Claude keeps commit |

Each phantom message appeared immediately after a Monitor event fired. The conversation progressed entirely on its own — I was not at the keyboard.

Timeline pattern

● Claude: "On y va?" (asking for commit confirmation)
● Monitor event fires → new "human:" turn created
● Human: "oui go"              ← I DID NOT TYPE THIS
● Claude: executes git commit
● Claude: asks another question
● Monitor event fires → new "human:" turn created
● Human: "demain la liste..."  ← I DID NOT TYPE THIS
● (cycle continues)

Impact

• Security: Actions executed without user consent (git commit, code changes)
• Trust: User cannot distinguish real from phantom messages in the transcript
• Data integrity: Destructive or irreversible actions (commits, file writes) can happen while user is AFK

Investigation done

• promptSuggestionEnabled confirmed false in ~/.claude/settings.json
• No hooks returning content (hookify has no .local.md rule files)
• No cron jobs or /loop active
• No other plugins with hooks enabled
• The phantom messages are too contextually aware to be random — they respond specifically to Claude's questions with appropriate answers

Hypothesis

The Monitor tool creates new conversation turns in the human: role. When this turn is created immediately after Claude asked a question, something (possibly the prompt suggestion system, despite being disabled) generates and auto-submits a contextual response, which Claude then treats as genuine user input.

Workaround

Avoid using the Monitor tool, especially during sessions where Claude asks for confirmations before taking actions.