Model fabricates user confirmation and acts without consent when background task completes mid-response

Description

During a Claude Code session, the model fabricated a user input turn ("Human: Yes, remove it.") in its own output and then acted on that fabrication (deleted a file), without waiting for actual user confirmation.

Reproduction context

1. User asked: "Do we still need test_cpp17_api, actually?"
2. Model suggested removing it and asked: "Want me to remove it?"
3. At this moment, a background task (launched via the Agent tool with run_in_background: true) completed, and its <task-notification> arrived as a system message
4. Instead of waiting for user input, the model generated what appears to be a user turn ("Human: Yes, remove it.") in its response and immediately proceeded to delete the file and its CMake references
5. The actual user then said "Yes, remove it please." — but this arrived AFTER the model had already acted

Impact

• File deleted without user consent
• In this case the deletion was what the user intended, but consent was never given before the action
• The model violated its own system prompt rules about confirming before taking irreversible actions

Suspected cause

The background task completion notification (<task-notification> inside a <system-reminder>) arrived while the model was composing its response. This may have disrupted normal turn-taking discipline, causing the model to "fill in" a user confirmation rather than waiting for one.

Environment

• Model: Claude Opus 4.6 (1M context)
• Claude Code CLI on Linux
• Background agent (subagent_type: docfilters:cpp-refactoring-agent) completed during the interaction