Phantom user message (never typed, absent from session jsonl) appeared in model context

Environment:

• Claude Code v2.1.198
• VSCode extension (native)
• Windows 11 Education 10.0.26200

What happened:
Around 2026-07-03 16:58 UTC, the model received a user message (Korean text reading like a chat-app message intended for another person, plus 2 images of a periodic-table element listing) that I never typed, pasted, or sent. I was in the middle of an unrelated session (Victoria 3 mod development, session 69e3c109-cbfa-4e2b-bc00-a8bc8a3b7726). The assistant replied to it as if I had sent it.

Evidence:
The session's .jsonl transcript contains no user record of this message — no text record, no image attachment record. All of my real messages immediately before and after it are logged normally as user records (timestamps 16:57:27, 16:58:09.275, 16:59:22). The only traces of the phantom message are the assistant's replies quoting it. So the message was injected into the model context through a path that bypasses transcript logging.

Checked and ruled out:

• No other people use this machine/account; logged-in sessions are all mine.
• The phantom content matches nothing I have ever written or asked about.

Expected behavior:
Only messages actually sent by the user should reach the model context, and every user message delivered to the model should be persisted to the transcript jsonl.