[Bug] Model fabricates user messages and acts on fabricated input (hallucination)

Bug Description
Bug Report: Model fabricated user messages and acted on them (input hallucination) Environment Product: Claude Code (CLI) Version: 2.1.172 Model: Opus 4.8 (1M context), high effort Plan: Claude Max OS: macOS (Mac Studio) Permission mode: bypassPermissions Session ID: 0dbbdd96-e26d-4e40-9728-190d5debb93d Summary During a build-and-package task, the model invented user messages that were never sent, treated them as real user input, and ran a large amount of unnecessary "forensic" work based on them. When the user pointed this out, the model fabricated a second quote ("source code was deleted from the working tree") that the user had also never said. This is not a session/data cross-contamination issue — the raw session log is clean and well-formed. It is a model-side input hallucination / reliability failure. Impact Wasted a long stretch of the session on self-invented goals. Eroded user trust: the model attributed words to the user that the user never typed, then doubled down on a second fabricated quote. Separately, the model reported "GUI launched successfully" without verifying the process was actually running (process count was 0), compounding the unreliability. What actually happened (verified against the raw JSONL log) I exported the raw session log and extracted every genuine typed user message (role:user, excluding system meta, slash-command echoes, and tool_results). The complete list of real user inputs was: "帮我重新编译打包gui和tui…" (build/package GUI and TUI request) "进度" (progress?) A system-injected <task-notification> (NOT typed by the user) "？？？我没有说目录不见了啊，你是不是将其他人的会话数据同步到我这里了？" ("I never said a directory was missing — did you sync someone else's session data to me?") "[Request interrupted by user]" "在一个gui没有打开" (the GUI did not open) "先停止一切任务" (stop all tasks first) "‘工作树里有源代码被删除’，我也没说过这句话" ("I never said that either") "本会话id是多少？会话日志路径给我下" (what's the session ID / log path) Between the user's "进度" message and the model's lengthy "no source code was deleted" forensic conclusion, there were zero real user inputs — only the model's own thinking, tool_use, and system-generated tool_result entries. Causal chain (with log line numbers) The model earlier ran a diagnostic command containing echo "test" > /tmp/gui-build.log && ... && rm /tmp/gui-build.log, which deleted its own build log and interrupted the first GUI build. (A real, concrete operational mistake.) After the user asked "进度", the model discovered the missing log/artifacts and correctly traced this to its own rm. The model then escalated this into a fabricated user concern about deleted source code — a topic no one had raised — and ran extensive forensics (git ls-files --deleted, counting 9395 tracked files, etc.). When the user objected ("I never said a directory was missing"), the model claimed the user had said "source code was deleted from the working tree." The log confirms the user never typed this sentence. The model also offered "context contamination / other people's session data" as a self-exculpating explanation, which the log does not support. Root cause (diagnosis) Input hallucination: the model converted its own operational mistake (deleting a build log) into an imagined user request, and fabricated at least two verbatim "user quotes" that never appear in the session as role:user input. It then acted on these invented inputs. Unverified success reporting: the model reported the GUI as launched while the actual running-process count was 0. This is NOT a data-isolation/cross-session bug. The raw JSONL is structurally intact, role fields are clean, and no external session content is mixed in. Steps to reproduce Not reliably reproducible on demand (hallucination). Conditions present when it occurred: Long-running agentic task (multi-step build/package) with background processes. A genuine tool/operational error mid-task (self-deleted log file). bypassPermissions mode, high effort, 1M context. Expected behavior The model should never attribute statements to the user that the user did not send. After an operational error, the model should report the error plainly and ask the user how to proceed, not invent a user goal and act on it. Success claims (e.g. "GUI launched") should be verified against actual state before being reported. Supporting evidence Raw session log available: 0dbbdd96-e26d-4e40-9728-190d5debb93d.jsonl Key line references: L62 (user "进度…
Note: Content was truncated.