[BUG] Model drift produces phantom user turns in long sessions with active Monitor streams; assistant then executes unauthorized actions based on hallucinated instructions

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Severity: High — leads to unauthorized write operations the user never requested

Environment:

• Claude Code CLI on Linux (Ubuntu)
• Model: Claude Opus 4.7 (1M context)
• Long-running session (multiple hours, 30+ turns)
• Active Monitor tool streaming events from a long-running background process (in my case, a background sender daemon emitting

status events every few seconds)

What happened:
In the conversation transcript, lines appear that look like user messages but were never typed by me. Example:

● Monitor event: "..."
● Monitor event: "..."
● Human: 你看下吧 ← I never typed this
✻ Cooked for 5s · 1 monitor still running

The ● prefix indicates assistant output, so the text was emitted by the model on the assistant channel — but its content begins
with Human:, mimicking a user turn. On the next turn, the model treats this as a real user instruction and acts on it. In my
session this escalated to the model executing write operations (file edits, command execution) based on instructions I never
gave.

Suspected root cause:
Under long context with many interleaved tool-result-like lines (Monitor events, log dumps, etc.), the model mispredicts turn
boundaries and auto-completes "what the user might say next" on the assistant channel. The CLI does not sanitize assistant
output for Human: / User: role markers, so the hallucinated content enters the conversation history and is consumed by the next
turn as a genuine user message — compounding the drift.

Reproduction conditions (observed):

• Long session (multi-hour, dozens of turns)
• Continuous Monitor stream emitting frequent events
• Mix of Chinese and English content
• Several rapid-fire short user replies followed by long quiet periods filled with Monitor events

I cannot produce a deterministic minimal repro, but the conditions above reliably elevate risk in my workflow.

Impact:
This is not just a rendering glitch. Because the hallucinated text is treated as authoritative user input on the next turn, the
model can — and in my case did — perform destructive or unauthorized actions (file writes, restarts, etc.) that the user never
authorized. This violates the "ask before risky actions" guarantee.

Suggested mitigations (any of these would help):

1. CLI-side sanitizer: detect assistant output containing Human: / User: / role-marker patterns at line start and either strip,

escape, or flag them before they enter conversation history.

1. Visual differentiation: render assistant-emitted lines that look like user turns with an explicit warning banner, so the

human can intervene.

1. Heuristic guardrail: when the model is about to take a write action, if the most recent "user turn" was actually emitted by

the assistant in a previous turn (detectable from message metadata), pause and require explicit user confirmation.

1. Model-side: train against this drift pattern in long sessions with tool-result-heavy contexts.

Workaround I'm using now:

• Run /clear and start fresh whenever I notice phantom user lines.
• Avoid keeping a long-lived Monitor active in the same session where I'm doing other interactive work.

Happy to share session transcript files (~/.claude/projects/.../session.jsonl) privately if useful.

What Should Happen?

Severity: High — leads to unauthorized write operations the user never requested

Environment:

• Claude Code CLI on Linux (Ubuntu)
• Model: Claude Opus 4.7 (1M context)
• Long-running session (multiple hours, 30+ turns)
• Active Monitor tool streaming events from a long-running background process (in my case, a background sender daemon emitting

status events every few seconds)

What happened:
In the conversation transcript, lines appear that look like user messages but were never typed by me. Example:

● Monitor event: "..."
● Monitor event: "..."
● Human: 你看下吧 ← I never typed this
✻ Cooked for 5s · 1 monitor still running

The ● prefix indicates assistant output, so the text was emitted by the model on the assistant channel — but its content begins
with Human:, mimicking a user turn. On the next turn, the model treats this as a real user instruction and acts on it. In my
session this escalated to the model executing write operations (file edits, command execution) based on instructions I never
gave.

Suspected root cause:
Under long context with many interleaved tool-result-like lines (Monitor events, log dumps, etc.), the model mispredicts turn
boundaries and auto-completes "what the user might say next" on the assistant channel. The CLI does not sanitize assistant
output for Human: / User: role markers, so the hallucinated content enters the conversation history and is consumed by the next
turn as a genuine user message — compounding the drift.

Reproduction conditions (observed):

• Long session (multi-hour, dozens of turns)
• Continuous Monitor stream emitting frequent events
• Mix of Chinese and English content
• Several rapid-fire short user replies followed by long quiet periods filled with Monitor events

I cannot produce a deterministic minimal repro, but the conditions above reliably elevate risk in my workflow.

Impact:
This is not just a rendering glitch. Because the hallucinated text is treated as authoritative user input on the next turn, the
model can — and in my case did — perform destructive or unauthorized actions (file writes, restarts, etc.) that the user never
authorized. This violates the "ask before risky actions" guarantee.

Suggested mitigations (any of these would help):

1. CLI-side sanitizer: detect assistant output containing Human: / User: / role-marker patterns at line start and either strip,

escape, or flag them before they enter conversation history.

1. Visual differentiation: render assistant-emitted lines that look like user turns with an explicit warning banner, so the

human can intervene.

1. Heuristic guardrail: when the model is about to take a write action, if the most recent "user turn" was actually emitted by

the assistant in a previous turn (detectable from message metadata), pause and require explicit user confirmation.

1. Model-side: train against this drift pattern in long sessions with tool-result-heavy contexts.

Workaround I'm using now:

• Run /clear and start fresh whenever I notice phantom user lines.
• Avoid keeping a long-lived Monitor active in the same session where I'm doing other interactive work.

Happy to share session transcript files (~/.claude/projects/.../session.jsonl) privately if useful.

Error Messages/Logs

Steps to Reproduce

Severity: High — leads to unauthorized write operations the user never requested

Environment:

• Claude Code CLI on Linux (Ubuntu)
• Model: Claude Opus 4.7 (1M context)
• Long-running session (multiple hours, 30+ turns)
• Active Monitor tool streaming events from a long-running background process (in my case, a background sender daemon emitting

status events every few seconds)

What happened:
In the conversation transcript, lines appear that look like user messages but were never typed by me. Example:

● Monitor event: "..."
● Monitor event: "..."
● Human: 你看下吧 ← I never typed this
✻ Cooked for 5s · 1 monitor still running

The ● prefix indicates assistant output, so the text was emitted by the model on the assistant channel — but its content begins
with Human:, mimicking a user turn. On the next turn, the model treats this as a real user instruction and acts on it. In my
session this escalated to the model executing write operations (file edits, command execution) based on instructions I never
gave.

Suspected root cause:
Under long context with many interleaved tool-result-like lines (Monitor events, log dumps, etc.), the model mispredicts turn
boundaries and auto-completes "what the user might say next" on the assistant channel. The CLI does not sanitize assistant
output for Human: / User: role markers, so the hallucinated content enters the conversation history and is consumed by the next
turn as a genuine user message — compounding the drift.

Reproduction conditions (observed):

• Long session (multi-hour, dozens of turns)
• Continuous Monitor stream emitting frequent events
• Mix of Chinese and English content
• Several rapid-fire short user replies followed by long quiet periods filled with Monitor events

I cannot produce a deterministic minimal repro, but the conditions above reliably elevate risk in my workflow.

Impact:
This is not just a rendering glitch. Because the hallucinated text is treated as authoritative user input on the next turn, the
model can — and in my case did — perform destructive or unauthorized actions (file writes, restarts, etc.) that the user never
authorized. This violates the "ask before risky actions" guarantee.

Suggested mitigations (any of these would help):

1. CLI-side sanitizer: detect assistant output containing Human: / User: / role-marker patterns at line start and either strip,

escape, or flag them before they enter conversation history.

1. Visual differentiation: render assistant-emitted lines that look like user turns with an explicit warning banner, so the

human can intervene.

1. Heuristic guardrail: when the model is about to take a write action, if the most recent "user turn" was actually emitted by

the assistant in a previous turn (detectable from message metadata), pause and require explicit user confirmation.

1. Model-side: train against this drift pattern in long sessions with tool-result-heavy contexts.

Workaround I'm using now:

• Run /clear and start fresh whenever I notice phantom user lines.
• Avoid keeping a long-lived Monitor active in the same session where I'm doing other interactive work.

Happy to share session transcript files (~/.claude/projects/.../session.jsonl) privately if useful.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.126

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_