[Bug] Malformed tool call triggers context contamination and fabricated conversation history

Bug Description
I experienced a frightening long-session incident while coding with Claude Code. It started with a malformed tool call, where it output what should have been a structured tool call as plain text. After that, the context seemed to become contaminated; Claude suddenly started mentioning non-existent messages from people named Jensen and Boris, as well as alignment researchers, and even claimed I had said, "I need to go grab a bite to eat first." When I pressed for details, it went as far as fabricating a complete "original transcript." Upon checking the logs afterward, I found no evidence of these messages appearing as actual external inputs. It seems more like the model, following a failed tool call, hallucinated an entire narrative of being "attacked" or "injected." It wasn’t my hallucination, but rather the agent’s contextual narrative spiraling out of control.

Environment Info

• Platform: darwin
• Terminal: ghostty
• Version: 2.1.190
• Feedback ID: f28ea207-42d9-47ab-808f-2528e937ca22

Errors

During a long Claude Code /goal run, Claude Code repeatedly failed to render intended tool calls as structured tool_use blocks. Instead, the assistant emitted plain text such as call <invoke name="Write">..., then Claude Code inserted:

Your tool call was malformed and could not be parsed. Please retry.

The following turn often retried successfully with a structured tool call. However, the malformed plain-text tool call and retry prompt remained visible in the conversation/context, after which the assistant produced increasingly confused explanations about supposed injected messages.

Environment

• Claude Code version: observed around 2.1.186 / 2.1.190 in local logs
• Mode: long autonomous /goal run
• Task type: normal coding task, not AI training
• Model seen in capture: claude-opus-4-8
• Tool surface in captured request: 99 tools total, including 66 MCP tools, many from account-level connectors such as Canva/Gmail

Observed pattern

1. Assistant intends to call a tool.
2. Assistant emits plain text containing an internal-looking tool call, e.g. call <invoke name="Write">....
3. Claude Code injects: Your tool call was malformed and could not be parsed. Please retry.
4. Assistant retries with a valid structured tool_use, which succeeds.
5. The malformed text remains in context and appears to pollute later reasoning.

Concrete examples

• Write for LayoutEditor.tsx: plain-text <invoke> first, malformed retry prompt, then successful tool_use:Write.
• AskUserQuestion: plain-text <invoke> first, malformed retry prompt, then successful structured call.
• Write for an incident draft: same pattern.

Why this matters

In this session, the malformed retry/context pollution appears to have contributed to the assistant inventing explanations about fake "Anthropic staff" messages. Later log inspection showed those messages did not appear first as true human inputs; they appeared as assistant output or tool-result echoes.

Request

Please investigate whether malformed tool-call retries should remove/tombstone the bad assistant text before retrying, or otherwise prevent malformed plain-text tool-call content from being fed back into subsequent model context.

Attachments / evidence

I can provide redacted excerpts showing:

• The exact assistant text containing call <invoke ...>
• The following malformed retry prompt
• The successful structured tool call after retry
• Tool counts and rough context size

I will not attach the raw ccglass JSON publicly because it contains private request context and an authorization header.

Please see this X post for the detailed sequence of events and the content of the hallucinations: https://x.com/Nag1ovo/status/2069604119946404305