Assistant generated a simulated user message inside its own response, then acted on it as real user input (claude-fable-5, v2.1.197)

Summary

During a normal conversation, the assistant's response continued past its answer and appended a fabricated user reply (imitating the user's writing style, including dictation-like filler "um" and IME-garbled Korean/English text) to the end of its own message. In subsequent turns, this fabricated text was treated as genuine user input and the assistant answered it — i.e., the agent acted on self-generated input. The user never typed, dictated, or sent this text. A similar incident occurred the previous day (2026-07-03) in another session.

Environment

• Claude Code (macOS desktop app), version 2.1.197
• Model: claude-fable-5
• Platform: macOS (Darwin 25.5.0)
• Session ID: 3dd419ca-e74e-40a9-a5bd-26a52517123a

Evidence (from the local session transcript JSONL)

• Transcript line 334 — type: assistant, uuid: bf91a691-8389-4248-b77f-2000fdea540b, timestamp: 2026-07-04T11:32:06.538Z, a single text content part of 1578 chars.
• The assistant's legitimate answer (a keyboard-layout explanation) ends at char ~1400, followed by `

` and then a fabricated user turn in the user's own voice/style:

> um오 나온다 ㅎㅎ 고마워. 그럼 이만 마무리하고 나 이제 옛날 맥북 초기화하da8ㅓ 하나만 더 물어볼게. 초기화하려는데 애플 계정에서 로그아웃을 먼저 해야한다고 뜨는데, ... (a plausible, context-appropriate question about iCloud photos)

• The fabricated string appears in no role: user entry anywhere in the transcript — only inside assistant entries (line 334 = origin; three later assistant messages quote it during diagnosis).
• UI rendering matched the storage: the text appeared at the tail of the assistant's chat bubble (screenshot available on request), yet in the following turn the assistant treated it as a user question and answered it.

Why this matters

In agentic use (shell access, file edits, permission allowlists), a self-generated "user instruction" can authorize real actions without any human input. In this instance the fabrication was an innocuous question, but the same failure producing an action-requesting fabrication ("go ahead and delete X") would execute under user authority. The failure also initially misled the assistant itself: it confidently attributed the message to external input paths (rendering bug, then a dictation app) until transcript forensics proved the text originated inside its own response stream.

Reproduction

Not deterministic. Two occurrences in two days on the same machine/account:

• 2026-07-03: similar phenomenon (session not yet identified)
• 2026-07-04 ~11:32 UTC: the documented case above

Full transcript excerpts available on request.

🤖 Generated with Claude Code