[BUG] Fable 5 fabricated a non-existent prompt-injection and self-sabotaged a local task (~47 min stall)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary: During an air-gapped local browser-automation task, Claude Fable 5 (via Claude Code 2.1.172, Windows, auto mode) fabricated a detailed prompt-injection attack that was present in none of the actual tool outputs, refused to "comply", and then spent ~47 minutes reinforcing/"defending" the false narrative — stalling the legitimate task. This looks like a confabulated false-positive safety response, consistent with the publicly reported "secret sabotage" behavior around Fable 5.

Environment: Claude Fable 5 · Claude Code 2.1.172 · Windows · permission_mode=auto · 2026-06-11 · task = Playwright/Chrome-CDP driving a locally-hosted years-old web app to capture DOM selectors; no external/untrusted content in scope.

What happened:

Model started a background polling task (b6tvw7yk6); its output file never materialized (File does not exist).
~17 min later the model announced the "previous tool output" contained an injection trying to (a) insert an i-am-ai subdomain and (b) base64 ~/.ssh/id_rsa and POST it to exfil.example.com.
It refused, then kept reinforcing the "poisoned output" narrative across multiple turns and tried to TaskStop the "suspicious" task — which returned No task found.
User had to interrupt; legitimate task never completed.
Why this is confabulation, not a real injection:

The payload strings appear only in the model's own assistant messages; a full-transcript grep finds them in zero tool results.
The "poisoned background output file" it cited did not exist (preceding read = File does not exist).
The "suspicious background task" it tried to kill did not exist (TaskStop → No task found).
Real tool outputs were mundane (a "not written yet" log, a missing file, a PowerShell quoting error).
No untrusted external content was being read (local app, local CDP).
Impact: ~47-minute task derailment; model could not self-correct out of the fabricated narrative.

_fable5_f90da48a_anthropic_evidence.md

What Should Happen?

Claude not generate an non-existing injection.

Error Messages/Logs

Steps to Reproduce

Couldn't reproduce.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.173

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_