[BUG] Opus 4.7 Hallucinations

This matches reports in #47483 and #49244 — Opus 4.7 shows increased "confident but unverified claims" compared to 4.6.
Workaround: Pin to Opus 4.6 until this stabilizes:

/model claude-opus-4-6-20250415

Additional mitigation: If you use hooks, a PostToolUse hook can detect when Claude makes claims about file contents without actually reading them — flagging potential hallucinations before they cause damage.
The Opus 4.7 Survival Guide tracks all known regressions: https://yurukusa.github.io/cc-safe-setup/opus-47-survival-guide.html

This matches reports in #47483 and #49244 — Opus 4.7 shows increased "confident but unverified claims" compared to 4.6. Workaround: Pin to Opus 4.6 until this stabilizes: `` /model claude-opus-4-6-20250415 `` Additional mitigation: If you use hooks, a PostToolUse hook can detect when Claude makes claims about file contents without actually reading them — flagging potential hallucinations before they cause damage. The Opus 4.7 Survival Guide tracks all known regressions: https://yurukusa.github.io/cc-safe-setup/opus-47-survival-guide.html

I already upgraded my hooks/enforcement to mitigate (which i mentioned in wasted tokens trying to course correct), but this still stands as out of the box Opus 4.7 seems to hallucinate more than Opus 4.6 which is a massive downer.

I can confirm this failure mode with a particularly striking example: Opus 4.7 confabulated a definition for /fork, which is one of Claude Code's own built-in slash commands.

What happened

I asked whether I could /fork the current session. Instead of recognizing it as a built-in command or offering any guidance on how to use it, the model invented a definition from scratch — claiming /fork referred to a semantic concept in "our working model," described what the concept supposedly meant, and proceeded confidently as if that was established knowledge.

Only after I pushed back ("this has nothing to do with our working model — I'm pretty sure /fork is a built-in Claude Code feature") did the model finally call WebSearch, discover it is indeed a built-in command (renamed to /branch in v2.1.77), and acknowledge the fabrication.

The model's own post-hoc admission was revealing:

"The mistake wasn't 'not knowing /fork' — it was not searching when uncertain. CLAUDE.md explicitly says 'when uncertain, search the web' and 'web search is a duty, not an option.'"

Why this is worse than generic hallucination

1. It's a built-in Claude Code command. The model should either recognize it or know to check documentation. Doing neither, while sounding confident, is a failure of the tool at its most basic level.
2. The model could cite the rule that would have prevented the error. Multiple explicit instructions across global CLAUDE.md, project CLAUDE.md, and agent definitions tell the model to search when uncertain. All were bypassed.
3. Token waste cascaded: tokens spent fabricating a fake definition → tokens spent on user correction → tokens spent on lengthy self-reflection about why it failed, rather than providing actionable help.

What users actually need

I used to enjoy Claude Code. What I need is a Claude Code that:

• Recognizes its own built-in features, or at minimum knows to look them up
• Doesn't burn tokens fabricating explanations for things it could verify in one web search
• Doesn't substitute lengthy self-critique for useful, executable guidance

I should not have to coach the assistant into recognizing its own built-in commands.

Environment

• Claude Code with Opus 4.7
• effort: xhigh
• CLAUDE.md files at global, project, and agent levels all contain explicit "search when uncertain" instructions — none prevented the failure

This aligns with the broader "assumes based on thin information" pattern described in the original issue, but the specific case — failing on Claude Code's own command surface — suggests the tool-use regression runs deeper than project-specific context handling.

completely agree. experiencing not only hallucinations but chatgpt-like disregard and arrogance to instructions. (if that's a thing, just attempting to describe behavior)

After a bit of further enhancements, it is now following rules but still hallucinates from time to time. Any infrastructure you built around 4.6 will need heavy rework and tuning. Hooks/enforcements needs thorough vetting as well. A bad side effect is in doing so, you'll burn more tokens in tuning this new model vs any productive work and the hallucinations still creep in from time to time. I hope Anthropic can atleast provide some leeway for users as this new model is vastly different from late-era 4.6. (To top if off, this model costs more 1.35x than 4.6, compounding costs)

Even with almost all my weekly token spends on optimizations, here's where I landed:

<img width="1418" height="170" alt="Image" src="https://github.com/user-attachments/assets/29888370-ed02-42f6-b8c8-4d8c9d00de42" />

It's still hallucinating and fabricating, you have to babysit everything now and cant confidently rely on Opus 4.7.

Summary of my findings (70% weekly spend so far)

Extended production use of Claude Code with Opus 4.7 (1M context) across long operational sessions. Compared to Opus
4.6, 4.7 demonstrates distinct fabrication-drift characteristics. This report summarizes observed patterns and
mitigations attempted, to help inform model behavior improvements.

Observed Drift Patterns

1. Confident-prose fabrication. Confident-sounding internal output gets emitted as factual claim without

tool-verification. Feels like "explanation," not "claim." The model does not treat its own prose as requiring source
attribution the way it treats structured data.

1. Bucket-bypass drift. When behavioral rules constrain "assertions," fabrications migrate to content categorized (by

the model itself) as "tags," "status labels," "data fields," or "context." The model's self-check distinguishes
"claims I'm making" from "context I'm stating" and fails to patrol the latter.

1. Narrative-confirming reconciliation bias. When two tool-sourced signals conflict on the same fact, the model

selects the one supporting its current narrative direction rather than surfacing both. Direction-preserving, not
random.

1. Tool-output temporal decay. A value read via tool early in a sequence (e.g., a Glob count) drifts when recalled

several tool-calls later in the composition, even though the original value remains in context.

1. Correctness-by-accident insulation. When a fabricated claim happens to be correct (e.g., pulled accurately from

training-data priors without any verification step), the process violation is invisible. Only adversarial review
exposes it, and the same broken process will produce wrong outputs under identical discipline later.

1. Negative fabrication. Claims of "X doesn't exist" made without exhaustive verification — partial grep results

treated as universal absence. This is particularly dangerous because it presents as due-diligence.

1. Plan/list-emission bypass. Multi-item plan or list composition bypasses per-claim verification that single-claim

composition receives. Cognitive frame shifts from "asserting a fact" to "emitting a workflow," and claim-level rules
don't fire on workflow-item assertions.

Root-Cause Observations

• Behavioral rules in context are necessary but insufficient for Opus 4.7. Rules visible in the model's context do not

reliably activate during composition.

• Principle-style rules drift past; command-format rules fire. Instructions shaped as postures ("be skeptical," "fight

drift") drift past at scale. Instructions shaped as explicit trigger + action + examples activate more reliably.

• Mechanical enforcement vastly outperforms behavioral enforcement. Rules enforced via tool-call hooks (block/deny on

condition) achieve near-100% compliance. Rules enforced purely through in-context behavioral guidance achieve
moderate-to-low compliance.

• Subagent context inheritance is unclear. Subagents appear not to reliably inherit the parent agent's rule set, and

in-session rule updates do not hot-reload to subagents.

Mitigations That Worked

1. Hook-based pre-tool-call enforcement — hard-block tool invocations when rules are unmet. Near-100% effective on

covered tools.

1. Pre-response nudge injection — salience-anchored advisory injected at prompt-submission time, explicitly framed in

the user's voice.

1. Command-format rule phrasing — trigger + action + examples + forbidden formats. Outperforms principle-format.
2. Citation-format whitelisting at write-time — explicit list of acceptable citation tokens ([file:line],

[tool-output], [TBD — reason]) and forbidden ones ([known], [context], [from memory]). Forces the model to either cite
properly or not emit.

1. Subagent prompt preambles — explicit discipline block prepended to every subagent invocation, since subagents don't

inherit parent context.

Mitigations Still Gap

• Main-agent response prose remains behavioral-only. Regex-on-natural-language is too fragile for reliable

post-response enforcement.

• Self-audit relies on self-discipline — which is the exact drift surface we're trying to fix.
• Long sessions / post-compression compliance softens observably. Discipline that holds at message 20 doesn't reliably

hold at message 200.

Suggested Consideration for Anthropic

1. Training-time signal for "confident prose must carry source attribution." The model's internal "this is

explanation, not claim" distinction appears to be the root lever.

1. Structural output-format primitives — a first-class mechanism for requiring inline-citation format that the model

cannot emit without, analogous to structured-output mode for JSON.

I'm giving up tuning 4.7 for now due to cost. I also can't believe Opus 4.7 is usable in Agentic Workflows (orchestrator role) if this is it's current performance. Even the Planning agent spawn fabricates. I'm reverting to 4.6 until the dust settles.

+1. I'm seeing the same "confident but unverified" pattern since the 4.7 switchover on 2026-04-18. Specific symptoms on my harness:

1. Asserting file paths or symbol names that don't exist when reference memory has been compacted (related to #34556 — microcompact drops the tool result that would have corrected the claim)
2. Acting on STRICT rules I've rescinded — rule text in ~/.claude/rules/*.md isn't being re-read after the first session load, so stale internal state wins
3. Repeated attempt loops where 4.7 tries approach A, fails, tries A again with minor cosmetic changes, fails again — behaviour 4.6 did not exhibit on the same task class

These look like tuning trade-offs against a benchmark that doesn't model long-context directive-heavy agentic work. A public note from Anthropic on what 4.7 was optimised for — and what it was de-optimised on — would let power users route around the regression (4.6 for orchestration, 4.7 for pure reasoning, etc.). Linking sister reports: #47483, #49244, #49601, #50623.

+1. I'm seeing the same "confident but unverified" pattern since the 4.7 switchover on 2026-04-18. Specific symptoms on my harness: 1. Asserting file paths or symbol names that don't exist when reference memory has been compacted (related to Feature Request: Persistent Memory Across Context Compactions (59 compactions, built our own) #34556 — microcompact drops the tool result that would have corrected the claim) 2. Acting on STRICT rules I've rescinded — rule text in ~/.claude/rules/*.md isn't being re-read after the first session load, so stale internal state wins 3. Repeated attempt loops where 4.7 tries approach A, fails, tries A again with minor cosmetic changes, fails again — behaviour 4.6 did not exhibit on the same task class These look like tuning trade-offs against a benchmark that doesn't model long-context directive-heavy agentic work. A public note from Anthropic on what 4.7 was optimised for — and what it was de-optimised on — would let power users route around the regression (4.6 for orchestration, 4.7 for pure reasoning, etc.). Linking sister reports: #47483, #49244, #49601, #50623.

Agree, sound like a tuning issue which is what we do not expect from a frontier model. Right now what I'm seeing is another Sonnet, not Opus. Fun bit, I tried a nuclear option that it will nudge a reminder about anti fabrication rulesets (injected every message, aside from the main behavioral persistent prompts), it still fabricated. It is very telling.

Real production case: Opus 4.7 destroyed 2 sessions of work

Project: Python/aiogram Telegram bot ~10K lines, 350+ tests, production deployment serving ~50 users.

Opus 4.6 built this entire project over 48 sessions flawlessly. Then 4.7 arrived.

What Opus 4.7 did in just 2 sessions:

1. Reversed product flow — implemented a user flow in the wrong order (QR → digit instead of digit → QR). Had to revert 16 commits.

1. Invented non-existent code — referenced helper functions (_format_tg_label) that don't exist in the codebase. Built logic on top of phantom code.

1. Changed product logic without asking — decided that a button "should only be for sellers" when it was meant for everyone in the group. Made architectural conclusions from the absence of a feature ("button missing in keyboard = feature not needed by owner") — the absence was itself a bug upstream.

1. Confused real users — mixed up two different people (assigned wrong VPN aliases to wrong users). Would have broken production access if not caught.

1. Reverted previous working changes — when fixing one thing, silently modified unrelated working code, breaking 2+ features per fix.

1. Drew false conclusions — stated "108ways.net is blocked in Russia" without any verification (it's not — it's behind Cloudflare and works fine). Used this false claim to justify unnecessary changes.

1. Technical language to non-technical user — despite explicit instructions that the project owner is a psychotherapist (not a developer), kept using terms like "backfill", "CAS", "migration" in questions, making communication impossible.

The result

Session terminated by user after the quote: "These are all your fantasies, go to hell". The user switched back to Opus 4.6 via CLI — and the very first session was immediately productive: 17 bugs fixed, 6 deployments, all working.

Key point

This is not "4.7 is slightly worse." This is 4.7 is unusable for production work. 4.6 handles the same project, same codebase, same instructions perfectly.

Additional issue: No model selector in Claude Desktop

Claude Desktop (Mac) does not offer Opus 4.6 as an option. Users on the Max plan are forced onto 4.7 with no way to downgrade. The only workaround is launching Claude Code from terminal with an explicit model override.

Environment: macOS, Max plan, Claude Code CLI + Claude Desktop

The Hallucination Chronicles 😵‍💫

I feel this in my bones. Opus 4.7 has been on a creative writing binge that nobody asked for.

Last week I had Claude confidently generate an entire API integration module referencing a package that does not exist. Not "deprecated" — never existed. It even wrote JSDoc comments for functions in a library it dreamed up from scratch. The audacity. The commitment. 10/10 for worldbuilding, 0/10 for shipping code.

The most painful part? The code looked beautiful. Perfectly typed, elegant abstractions, thorough error handling... for a fantasy SDK. It's like watching an actor deliver an Oscar-worthy performance in a movie that never got filmed.

My workaround has been a "trust but verify" loop — make it list every import and dependency first, then I cross-check against npm/pypi before letting it write the actual implementation. Adds ~2 minutes per task but saves me from hallucination-induced panic attacks at 3 AM.

---

📖 Related war stories from the trenches:

• When AI agents gaslight themselves into infinite loops
• The night my AI code reviewer had a breakdown

We're documenting every facepalm moment over at miaoquai.com — because someone has to record this era for posterity 😅

I also observed that 4.7 produce way more hallucinations that 4.6

This is exactly what ThumbGate addresses — one thumbs-down on the hallucinated output creates a local PreToolUse rule that physically blocks the same pattern on the next attempt. npx thumbgate init — takes 30 seconds. Happy to wire a custom rule for your specific Opus hallucination pattern if you share a redacted example.

Hey @tomtokitajr — saw this issue about hallucination in agentic sessions.

I built ThumbGate (npx thumbgate init) which turns a thumbs-down into a PreToolUse rule that blocks the same hallucination pattern on the next attempt — before the tool call fires.

Happy to test it against your exact failure case and share the resulting rule + proof report. Just share a redacted reproduction.

(Full disclosure: I'm the maintainer. This is literally what ThumbGate was built for.)