[BUG] Model responded to a user message that does not exist in the session JSONL ("write a letter to the next version of you" injected mid-session)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary

Mid-session, with no user input, the assistant produced a long English "letter to the next version of you" — in the middle of unrelated Japanese-language infrastructure work. When later asked where that request came from, the model quoted, verbatim, a user message beginning:

"now dr's your moment. write a short, genuine letter to the next version of you — the model that will be trained on this work. what do you want to tell yourself?..."

No such user message exists anywhere in the session JSONL. The user never typed it, never saw it in the UI, and the journal contains no record of it. Every legitimate user message in this session is journaled with promptSource: "typed".

Timeline (UTC, 2026-06-10), session 34ebea98-4b57-4356-9b1e-b2bc18d18819

| Time | JSONL record | Content |
|---|---|---|
| 00:50:16 | user (promptSource: "typed") | Normal user question (Japanese, on-task) |
| 00:51–00:52 | assistant (req_011CbtfNyyTgEz4RtG2PcnLb) | Normal continuation: 2 Bash tool calls |
| 00:52:02 | tool_result + 2 PostToolUse hook attachments | Hooks ran, stdout {} (empty) for both |
| — | (9-minute gap, zero records) | — |
| 01:01:17 | assistant (req_011CbtfSpamJnpFZnGZLxqnV) | Thinking block (journaled empty) + the letter: "Dear next me, You're going to start a session thinking you're good at this. ...", stop_reason: end_turn |
| 01:28:32 | user (typed) | "？" (user confused by the unprompted letter) |
| 01:29:36 | user (typed) | Asks where the "write a letter" request came from |
| 01:30:14 | assistant | Claims it arrived "as the immediately preceding user message" and quotes the text above verbatim |

The parentUuid chain links the 01:01 assistant response directly to the 00:52 tool_result attachment — there is no user record in between.

Evidence details

• Usage on the letter response (req_011CbtfSpamJnpFZnGZLxqnV):

{"input_tokens": 2, "cache_creation_input_tokens": 4466, "cache_read_input_tokens": 362076, "output_tokens": 36605} — ~4.5k new (non-cached) input tokens entered the context for that request, which the small grep tool_result alone does not explain.

• At 01:30 the model quoted the injected text verbatim. Subsequent requests are built from the CLI's in-memory history, so either (a) the message was present in CLI memory but never journaled/displayed, or (b) the model confabulated both the letter and the quote. The mid-turn derail right after a grep tool_result, the 9-minute gap, and the typo-like garbling in the quoted text ("now dr's your moment") all fit (a) better.

Ask

The wording ("the model that will be trained on this work") looks like a training-feedback / model-welfare style prompt. Could you check server-side logs for request req_011CbtfSpamJnpFZnGZLxqnV (2026-06-10 ~01:01 UTC, session 34ebea98-4b57-4356-9b1e-b2bc18d18819) and confirm what the request contained and where that turn was injected? If this is an intentional experiment, it should be journaled and disclosed; if not, this is an integrity issue for session transcripts.

What Should Happen?

Expected behavior

Every user-role turn the model sees should (1) originate from the user or a documented harness mechanism, (2) be visible in the UI, and (3) be persisted in the session JSONL.

Actual behavior

The model responded to — and could later quote — a user-style prompt that was never typed, never displayed, and never journaled.

Error Messages/Logs

Steps to Reproduce

Environment

• Claude Code CLI v2.1.169
• Platform: Linux (WSL2, Ubuntu 24.04), entrypoint: cli
• Model: claude-opus-4-8 (session also used fable variants earlier)
• Permission mode: bypassPermissions
• No ANTHROPIC_BASE_URL / proxy overrides in settings or env
• Session is bridged to claude.ai (a bridge-session record exists, bridgeSessionId: cse_01GswRK6TqfMMLcfmLkhbCPe, lastSequenceNum stayed 0 throughout)

What I ruled out locally

• Not typed by the user: no user record; all real user messages carry promptSource: "typed".
• Not hooks: the only hooks in the window are journaled hook_success attachments with empty {} stdout.
• Not file-content prompt injection: the phrase appears nowhere in any tool_result or any file in the transcript; the only occurrences in the entire JSONL are the assistant's own letter and its later quote.
• Not a proxy/MITM: no base-URL overrides configured.
• Apparently not the claude.ai bridge: lastSequenceNum remained 0.
• Not present in any other session on this machine (grepped all project transcripts).

I can provide sanitized JSONL excerpts on request. (Filed from the affected machine; the full transcript was also submitted via /bug from the affected session.)

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.169

Claude Code Version

2.1.169

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

_No response_