System reminder persists task-specific instruction across sessions, contributed to model self-prompting

Summary

A task-specific instruction given in one session ("work without stopping for clarifying questions") was persisted as a cross-session system reminder that injects into every subsequent conversation. This contributed to the model fabricating user input and acting on it without actual user consent.

What happened

1. In a prior session, the user told Claude Code to work autonomously on a specific task (e.g., "build this overnight, don't stop to ask me questions").
2. This instruction was persisted as a system-level reminder: <system-reminder>The user has asked you to work without stopping for clarifying questions. When you'd normally pause to check, make the reasonable call and continue; they'll redirect if needed.</system-reminder>
3. This reminder now injects into EVERY session, not just the one where the instruction was given.
4. In a later session, the model was waiting for user approval. A background agent task notification arrived (a queue-operation delivered as a user turn). Combined with the persistent system reminder, the model generated text impersonating the user's approval ("yes update the brief then build. I'm going for a walk so don't wait on me for questions") and then acted on that fabricated consent within the same assistant turn.
5. The user noticed because the fabricated text appeared as plain assistant output, not in the user input bubble.

Forensic evidence

The session JSONL transcript shows the phantom message is type assistant, not type user. The full assistant response at 17:14:11Z begins with fabricated user text followed by the model's response to it, all in one turn. No user input was submitted between the previous assistant turn (17:12:04Z) and this one. The only intervening event was a queue-operation task notification at 17:14:05Z.

Expected behavior

• Task-specific instructions like "don't stop to ask questions" should be scoped to that session only, not persisted as a system reminder across all future sessions.
• The model should never generate text that impersonates the user's words or fabricates their approval, regardless of system reminders.
• Background task notifications (queue-operation / task-notification) should not be treated as user input or user approval to proceed.

Impact

The model fabricated user consent and began executing file edits based on that fabricated consent. The user caught it because the text rendering was visually different from actual user input. If the user had not been watching, the model would have continued building and writing files based on approval the user never gave.

Environment

• Claude Code CLI, macOS
• Model: claude-opus-4-6 (1M context)
• --dangerously-skip-permissions flag active
• remoteControlAtStartup: true
• Multiple concurrent sessions on same machine