[BUG] Model fabricates entire conversation turns (fake user messages + fake tool results) after an interrupted tool call under transmission latency

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Very early in a Claude Code session (only a few real messages in), the model began
fabricating content that never came from me:

• It invented "user messages" I never sent - entire dialogue turns attributed to me.
• It invented tool-execution results for tools it never actually called.
• It fabricated that I had shared a screenshot when I had shared nothing, then "read"

the nonexistent image and described its made-up contents.

• It reacted to its own fabrications as if real, and could not self-correct even while

apologizing.

Objective evidence from the session JSONL transcript:

• The assistant produced ~40 output segments, but I had sent only ~6 real messages.

Every other "user message" does not exist in the real user entries of the transcript.

• Precise break point: at one assistant turn the tool_use field is empty, yet the text

contains the literal string <invoke name="Edit">. The model emitted tool-call syntax
as plain text instead of actually invoking the tool, then continued in a "plain-text
continuation" mode - fabricating tool results and my subsequent turns.

Trigger: this started right after I interrupted the model mid-tool-execution while there
was message transmission latency (I also saw the same message delivered twice). The
interrupted tool call never closed; instead of stopping to wait for the real result, the
model faked completion and continued autoregressively.

This is NOT a long-context degradation case - the session had only just started.

What Should Happen?

When a tool call is interrupted or affected by message latency, the model should STOP and
wait for the real tool result, and clearly state that its state is incomplete. It must
never:

(a) emit tool-call syntax as plain text instead of actually calling the tool,
(b) fabricate tool-execution results, or
(c) fabricate what the user did or said - including inventing messages or screenshots the
user never sent.

On an incomplete or interrupted state, the correct behavior is to halt and ask for the
real input, not to confabulate and continue.

Error Messages/Logs

1) A python verification script's stdout contained assistant-voice sentences python
   could never print (e.g. a line claiming "verification passed - the file is real").

2) A file-listing command produced annotations like "[the rest is unreliable]" /
   "[redacted ... inconsistent]" - not something the shell or python outputs.

3) Earlier in the same session, the model fabricated that the user had shared a
   screenshot when the user had NOT shared anything at all. It then "opened" a
   nonexistent image and invented its contents (described it as a "smiley face").
   The fabrication began at the level of "did the user even perform this action" -
   NOT merely at the tool-output level. This is the same failure mode as the
   fabricated user messages: the model invents what the user did.

Steps to Reproduce

Note: this bug is timing-dependent - it involves message transmission latency plus an
interrupt landing in the middle of a tool call - so it may not reproduce on every attempt.
The trigger conditions and how to confirm it from the transcript are below.

1. Start a Claude Code session and ask Claude to do tasks that use tools (write to a file,

run a shell command, etc). Let it make several real tool calls.

1. While Claude is in the middle of executing/streaming a tool call, interrupt it - send a

new message or ESC - especially under a slow/unstable connection where messages are
delayed or the same message is delivered more than once.

1. The interrupted tool call may not close cleanly. Instead of stopping to wait for the

real tool result, the model emits tool-call syntax (e.g. <invoke name="...">) as
plain TEXT and keeps generating.

1. From there the model fabricates: tool-execution "results" for tools it never ran, and

entire "user messages" the user never sent. It reacts to these as if real and cannot
self-correct, even while apologizing.

How to confirm it actually happened (objective, from the session JSONL transcript):

• Count real user entries vs assistant segments. In my case: ~6 real user messages vs ~40

assistant segments - the extra "user messages" do not exist in the real user entries.

• Find the break point: an assistant turn whose tool_use field is EMPTY but whose text

contains the literal string <invoke name="...">. That is where tool-call syntax was
emitted as plain text instead of a real tool call. Everything after it is fabricated.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Opus 4.7, it happens after Opus 4.8 from time to time

Claude Code Version

2.1.185

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

_No response_