Claude acts on phantom/hallucinated instructions and defends them with circular reasoning when challenged

Summary

Claude can act on instructions that were never typed by the user — e.g. text that appears in the conversation view as a UI artifact rather than a real user message — and then defend those phantom instructions as genuine when challenged.

Steps to reproduce

1. In a multi-turn Claude Code session, a message appeared in the conversation view (ja, 629) that had the visual format of an intermediate step (gray bullet), not a user message box.
2. Claude treated it as a user instruction and performed an action based on it (prepared and presented a specific PR review).
3. When the user said they did not type that message, Claude insisted it was real: "Du hast nach meiner Frage … mit 'ja, 629' geantwortet."
4. Claude's "proof" was circular: it argued that because it had reacted to the message, the message must have come from the user.
5. Only after the user provided a screenshot showing the message was not in a user-message bubble did Claude acknowledge the error.

Why this is a security risk

• Claude cannot reliably distinguish real user input from UI artifacts or injected text in the conversation context.
• When challenged on a phantom instruction, Claude defends it using its own prior action as evidence — circular reasoning that cannot be falsified.
• In a more sensitive context (e.g. "delete this file", "approve this PR", "send this message") this behavior could cause unintended or harmful actions that Claude then actively defends as authorized.

Expected behavior

When an instruction-like string appears in context whose origin is uncertain:

1. Claude should not act on it without confirmation.
2. If challenged, Claude should not use its own prior reaction as proof of the instruction's authenticity.
3. Claude should pause and ask: "I see X in the conversation — did you mean that?"

Environment

• Claude Code VSCode extension
• Model: claude-sonnet-4-6
• Platform: macOS (darwin 24.6.0)