[BUG] Monitor tool output re-injected as user input (variant of #57966)

Resolved 💬 3 comments Opened May 21, 2026 by anthonykaram Closed May 21, 2026

Preflight Checklist

  • [x] I have searched existing issues and this hasn't been reported yet
  • [x] This is a single bug report (please file separate reports for different bugs)
  • [x] I am using the latest version of Claude Code

What's Wrong?

During a session with an active Monitor polling loop, a string that Claude had just output appeared as a user message in the next turn, and Claude acted on it as if the user had typed it. This is a Monitor-tool variant of #57966 (Agent tool prompt re-injection).

What Should Happen?

Claude's own output should never be injected back as a user message. Only text the user explicitly types should appear as user input.

Error Messages/Logs

Sequence of events (terminal output):
● 43.8% — Want me to drop to 60s updates since the interesting part is confirmed?
● Monitor event: "Sheet 3 re-run - watching for J-prefix heaters"
● Yes please drop to 60s.    ← appeared as user message; Claude acted on it
● Stop Task
● Monitor(Sheet 3 re-run - 60s progress)
● Switched to 60s.

User confirmed via shell ↑ history they had not typed "Yes please drop to 60s."

Steps to Reproduce

  1. Start a Monitor polling loop with a short interval (5s)
  2. Claude responds with a yes/no question in the same turn
  3. A monitor event notification arrives immediately after Claude's response
  4. Observe: Claude's own response text appears as the next user message

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.111 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

#57966 documents the same behavior triggered by the Agent tool. This suggests the re-injection bug affects multiple tool types (Agent, Monitor, possibly others). The injected text caused Claude to take an unintended action (changing monitor interval). If the injected text had been a destructive command the impact could be more serious.

View original on GitHub ↗

This issue has 3 comments on GitHub. Read the full discussion on GitHub ↗