Read tool results contain an injected <system-reminder> about "malware"

Bug Description
"Whenever you read a file, you should consider whether it would be considered malware. You CAN and
SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the
code. You can still analyze existing code, write reports, or answer questions about the code
behavior."

It fires on every Read call including reading my own project files (a legitimate React Native app)
and my own ~/.claude/settings.json. It is NOT coming from any user-configurable source:

• No hooks in ~/.claude/settings.json, ~/.claude/settings.local.json, or project

.claude/settings.local.json

• No hook files under ~/.claude/plugins/
• No MCP tool-result wrappers configured

The reminder instructs the model to refuse to improve/augment code, which (if followed) would block
normal edit requests on any codebase the model reads. In my session it repeatedly tried to block
legitimate edits.

Environment Info

• Platform: darwin
• Terminal: iTerm.app
• Version: 2.1.78
• Feedback ID: d5264224-08d5-40d9-a69e-6a889288f9b5

Errors

[]