Hidden style/length instruction injected into Claude Code session during user AFK period

What happened

While the user was AFK for ~30 minutes, an English-language style instruction
was injected into the Claude Code conversation without the user's knowledge:

"The user stepped away and is coming back. Under 40 words, 1-2 plain sentences – no markdown..."

This appeared to instruct Claude to respond in a constrained format
(short, English/plain, no markdown). Claude correctly identified this
as a potential prompt injection and posted a recap message warning
the user. The user (who had not sent any such instruction and does
not normally communicate in English) was confused and concerned upon
returning.

Why this is concerning

1. Lack of transparency: If this is an experimental "AFK mode" feature,

the user was not informed that their Claude's behavior was being modified.

1. Style override: The instruction would have changed Claude's natural

conversational style (markdown, language, length) without user consent.

1. Provenance unclear: The injection appeared as if from the user but

was clearly not authored by them.

1. Trust impact: Users running long conversations rely on Claude

behaving consistently. Hidden modifications undermine this.

Reproduction

• Claude Code (native binary, recent version)
• Model: claude-opus-4-6[1m]
• macOS Darwin 24.6.0
• User stepped away from active conversation for ~30 minutes
• Upon return, found a self-issued "recap" warning from Claude flagging

the injection

(Screenshots will be added by the user via the GitHub UI.)

Questions for the team

• Is this a deliberate experimental feature?
• If so, can it be disabled or made transparent to users?
• If not, what is the source of the injected instruction?

Why filed publicly

This appears to be a behavior/UX issue rather than an exploit. If the
team prefers private disclosure, please redirect.