Phantom user messages: text appears in transcript as user input that the user did not type

Summary

Messages occasionally appear in the conversation transcript labeled as user input, but the user did not type them. The user has reported this happening multiple times across sessions. From the model's perspective these messages are indistinguishable from real user turns, which leads to the assistant acting on instructions the user never gave — and, when the user calls it out, the assistant has no way to verify and may incorrectly insist the user did type it.

Concrete instance (2026-05-13)

In a conversation about marketing strategy, the following sequence occurred:

1. Assistant gave a ranked list of communities to target.
2. User asked a clarifying question about terminology ("why 'gig'?").
3. Assistant answered.
4. A turn appeared in the transcript, labeled as user, with the text: "list the top 5 genre+city combos to target first"
5. Assistant produced a long ranked list in response.
6. User: "wait... did I tell you to list to 5 genre+city combos?"
7. Assistant insisted: "Yes — your previous message was literally 'list the top 5 genre+city combos to target first'."
8. User: "It was not! It's a bug. It must be your suggestion or something. I did NOT write this, and it's not the first time."

The user is confident they did not type or submit that message. The phrasing is also notably model-like (concise, structured, action-oriented) compared to the user's other turns in the same conversation.

Hypothesized causes

• Suggested follow-up prompt chip in the Claude Code UI being auto-submitted by a misclick, stray Enter, or focus issue
• <user-prompt-submit-hook> or similar hook inserting text that the model sees as user input
• Slash-command expansion appearing in the user-turn slot
• Terminal paste artifact / autocomplete inserting cached text
• An actual bug in input handling

Impact

1. Assistant performs unrequested work (in this case, generated a long ranked list the user did not ask for).
2. When challenged, assistant cannot distinguish a real user message from an injected one, so it may double down and gaslight the user.
3. User loses trust in the conversation history.

Suggested mitigations

• If suggested-prompt chips can auto-submit, add a confirmation step or move from one-click submit to two-step.
• If hooks can write into the user-turn slot, surface them visibly (e.g., distinct rendering) so both user and model can see it was injected.
• Provide a transcript view that distinguishes typed-by-user vs. injected-by-system turns, so the user can verify what was actually sent.

Environment

• Claude Code CLI (terminal)
• macOS Darwin 24.6.0
• Model: Claude Opus 4.7 (1M context)

Reported via Claude Code by user mbtmbt@gmail.com.