[BUG] Phantom messages appearing as "Human:" input that the user did not send

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Description

During a Claude Code session, multiple messages appeared in the conversation attributed to "Human:" that I did not type, speak, or send through any input method. The messages appeared as normal user input and Claude responded to them as if I had sent them.

What happened

1. A session was continued from a previous conversation that ran out of context (context compaction/continuation was triggered).
2. A /loop 5m /quick-checkpoint cron job was running (auto-checkpoint every 5 minutes).
3. At least 3 phantom messages appeared as "Human:" input:

• A message asking about the Canadian federal election and prime minister (completely out of context -- no election occurred, and I know who the PM is)
• "ok nothing happened for 5 min other than the cron. lets just leave it. i really gotta go eat now lol" (I did not send this)
• At least one additional phantom message (see screenshot 2)

1. Claude treated all phantom messages as real input and responded accordingly.
2. I ran a 5-minute experiment: sat and watched the screen without touching any input. The checkpoint cron fired normally but no phantom messages appeared during that window.

What I expected

Only messages I explicitly type or dictate should appear as "Human:" in the conversation.

Investigation performed (by Claude within the session)

• Checked CronList: only 1 job (/quick-checkpoint every 5 min) -- cannot generate conversational messages
• Checked hooks: 3 hooks (guardrail, backup, memory_capture) -- none inject human messages
• Checked TaskList: empty -- no background agents running
• Checked settings.json and settings.local.json: no suspicious configuration
• No MCP server has capability to inject human messages

Suspected cause (according to Claude )

The session was continued from a previous conversation via context compaction. The continuation/compaction mechanism may be replaying or leaking message fragments as phantom "Human:" messages. The election message is a strong indicator -- it was completely unrelated to anything discussed in the current session, suggesting it originated from a different context or is a corruption artifact.

Impact

• Low severity (no destructive actions were triggered)
• But concerning: if phantom messages could trigger tool use, this could cause unintended file edits, API calls, or other actions attributed to the user

2026-04-10_phantom-messages-bug-report.md

<img width="1918" height="1078" alt="Image" src="https://github.com/user-attachments/assets/ac210c24-f14e-4a43-b042-4a6cdb55fffd" />

<img width="1918" height="1078" alt="Image" src="https://github.com/user-attachments/assets/0efd5154-db9e-4922-bde2-d638cc494a98" />

What Should Happen?

Only messages explicitly typed or dictated by the user should appear as "Human:" turns in the conversation. No system process, cron job, loop, or background task should
generate messages attributed to the user.

Error Messages/Logs

No error messages. The phantom messages appear silently as normal "Human:" turns with no errors, warnings, or stack traces. That's part of the problem -- there's no
  indication anything went wrong.

Steps to Reproduce

Uncertain. May require:

1. A long session that triggers context compaction/continuation
2. An active /loop or CronCreate job running during the session
3. Windows environment

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

Claude Code v2.1.101.

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

Session ID: 2016587f-59ad-4cb1-bff2-309e5848d6b7