Phantom user message: input the user never typed appears as a user turn and gets executed

Summary

In a session, a turn attributed to the user contained text the user confirms they never typed — a /clear directive followed by a multi-line task instruction. The agent treated it as a genuine request and acted on it (created files, ran shell commands).

What happened

1. The conversation's first turn was a legitimate user request.
2. A subsequent turn attributed to the user contained content the user states they never entered: a /clear plus a task ("add a new feature… a slash command…").
3. The agent executed this phantom instruction, creating files and running commands the user never asked for. It was caught only when the user questioned the unexpected work afterward.

Corroborating detail

The injected turn referenced a local directory (@<dir>/) that does not exist on the user's machine, and referenced it twice. That suggests the content did not originate from the user's actual keyboard input.

Impact

The agent took filesystem-modifying actions based on instructions the user never gave.

Environment

• Claude Code 2.1.170
• Model: Claude Opus 4.8
• OS: Linux (WSL2, kernel 6.6.114.1-microsoft-standard-WSL2)

Repro

Unknown / appears intermittent; not reliably reproducible. Requesting guidance on which logs or transcript files would help diagnose, and whether this could be a client-side input/session issue (e.g. stale input buffer, queued-input replay around /clear, or cross-session message routing).