[Bug] Anthropic API: Model-generated text injected into tool_result stream causing silent write failures

Bug Description

Summary

Model-generated text is injected into the tool_result stream — text that does
not exist in the actual command/tool output. Same family as #70900 / #64048,
but here it also corrupts the WRITE path (silent data-integrity failure).

Environment

• Claude Code: 2.1.156
• Model: Opus 4.8 (claude-opus-4-8)
• Platform: macOS (darwin)

Symptoms observed in a single session (~6 occurrences)

1. Bash: fabricated a ~200-line sources: list (fake "@masao_*.md" entries)

that did not exist. Ground truth on re-run: the file had 4 entries, zero
"@masao". Verified by re-running with ls + exit=$? + reading via the
file Read tool.

1. Read tool: returned file contents as if read, but a subsequent Edit failed

with "File has not been read yet" — i.e. the prior "Read" was fabricated.

1. Write tool: returned "File created successfully at: <path>" while the file

was NOT created (confirmed by ls → No such file; exit=127 on later use).
A second real Write succeeded. => SILENT WRITE FAILURE.

1. The harness itself emitted "tool result injection detected" warnings during

these events — detection exists, but fabricated content still reached the model.

Why this is higher severity than read-side fabrication alone

The false Write "success" (#3) is a silent state-corruption bug: an index entry
was created pointing to a file that did not exist. A user who trusts the
"success" message would never know data was lost. Read-side fabrication at least
tends to surface as a downstream error.

Repro shape

Long-running session, high context, frequent tool calls (Bash/Read/Write),
non-ASCII (Japanese) filenames. Re-running the same command with explicit
exit-code checks exposes the discrepancy between the injected and real output.

Environment Info

• Platform: darwin
• Terminal: Apple_Terminal
• Version: 2.1.196
• Feedback ID: 15dd0a31-cc7a-4292-9c2b-3f799aa8c64e

Errors

[]