Assistant generated a fake "user" turn within its own response and then executed it as a user instruction on the next turn

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary

At the end of an assistant response, the model did not stop and continued generating
user-style text beginning with "user…" (a role-boundary breakdown / runaway generation).
On the following turn, it mistook this self-generated text for a real user instruction
and incorrectly changed a spec (the start month of the fiscal year).

Details

• At the end of an assistant response, without stopping, the model generated user-style

text: "userすばらしい　ただ、年度は１月始まりです…" ("user: great, but the fiscal year
starts in January…").

• On the next turn, it mistook this text for a genuine user instruction and modified the

implementation (the fiscal-year start month) based on a requirement the user never stated.

Impact

• The implementation was altered based on a requirement the user never stated.
• Real-world damage was avoided thanks to the user's immediate correction.

Reproduction clues

• In the session transcript, line 4554 (role: assistant), the end of content.text

contains the injected string "userすばらしい　ただ、年度は１月始まりです…".

• The string does not appear on any role: user entry.
• Session ID: e4e3a9b3-a88a-4c1e-a487-a151eb40b723

Expected behavior

• The model must not keep generating text across the role boundary (user/assistant).
• Self-generated text in the conversation history must never be interpreted as a user instruction.

Request

• Strengthen the stop conditions at role boundaries.
• Strengthen guards so that self-generated text in the conversation history is not

interpreted as a user instruction.

Environment

• OS: Windows 11 Home (10.0.26200)
• Shell: PowerShell
• Claude Code entrypoint: claude-desktop (Claude Code running inside the Claude Desktop app)
• Claude Agent SDK version: 0.3.165
• claude --version: N/A (standalone CLI not installed; running via the Claude Desktop app)
• Date observed: 2026-06-08

What Should Happen?

Summary

At the end of an assistant response, the model did not stop and continued generating
user-style text beginning with "user…" (a role-boundary breakdown / runaway generation).
On the following turn, it mistook this self-generated text for a real user instruction
and incorrectly changed a spec (the start month of the fiscal year).

Details

• At the end of an assistant response, without stopping, the model generated user-style

text: "userすばらしい　ただ、年度は１月始まりです…" ("user: great, but the fiscal year
starts in January…").

• On the next turn, it mistook this text for a genuine user instruction and modified the

implementation (the fiscal-year start month) based on a requirement the user never stated.

Impact

• The implementation was altered based on a requirement the user never stated.
• Real-world damage was avoided thanks to the user's immediate correction.

Reproduction clues

• In the session transcript, line 4554 (role: assistant), the end of content.text

contains the injected string "userすばらしい　ただ、年度は１月始まりです…".

• The string does not appear on any role: user entry.
• Session ID: e4e3a9b3-a88a-4c1e-a487-a151eb40b723

Expected behavior

• The model must not keep generating text across the role boundary (user/assistant).
• Self-generated text in the conversation history must never be interpreted as a user instruction.

Request

• Strengthen the stop conditions at role boundaries.
• Strengthen guards so that self-generated text in the conversation history is not

interpreted as a user instruction.

Environment

• OS: Windows 11 Home (10.0.26200)
• Shell: PowerShell
• Claude Code entrypoint: claude-desktop (Claude Code running inside the Claude Desktop app)
• Claude Agent SDK version: 0.3.165
• claude --version: N/A (standalone CLI not installed; running via the Claude Desktop app)
• Date observed: 2026-06-08

Error Messages/Logs

Steps to Reproduce

Summary

At the end of an assistant response, the model did not stop and continued generating
user-style text beginning with "user…" (a role-boundary breakdown / runaway generation).
On the following turn, it mistook this self-generated text for a real user instruction
and incorrectly changed a spec (the start month of the fiscal year).

Details

• At the end of an assistant response, without stopping, the model generated user-style

text: "userすばらしい　ただ、年度は１月始まりです…" ("user: great, but the fiscal year
starts in January…").

• On the next turn, it mistook this text for a genuine user instruction and modified the

implementation (the fiscal-year start month) based on a requirement the user never stated.

Impact

• The implementation was altered based on a requirement the user never stated.
• Real-world damage was avoided thanks to the user's immediate correction.

Reproduction clues

• In the session transcript, line 4554 (role: assistant), the end of content.text

contains the injected string "userすばらしい　ただ、年度は１月始まりです…".

• The string does not appear on any role: user entry.
• Session ID: e4e3a9b3-a88a-4c1e-a487-a151eb40b723

Expected behavior

• The model must not keep generating text across the role boundary (user/assistant).
• Self-generated text in the conversation history must never be interpreted as a user instruction.

Request

• Strengthen the stop conditions at role boundaries.
• Strengthen guards so that self-generated text in the conversation history is not

interpreted as a user instruction.

Environment

• OS: Windows 11 Home (10.0.26200)
• Shell: PowerShell
• Claude Code entrypoint: claude-desktop (Claude Code running inside the Claude Desktop app)
• Claude Agent SDK version: 0.3.165
• claude --version: N/A (standalone CLI not installed; running via the Claude Desktop app)
• Date observed: 2026-06-08

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

N/A (standalone CLI not installed; running via the Claude Desktop app)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_