Fable 5 fabricated a user turn mid-response and then acted on it (role leakage / missing end_turn)

Environment: Claude Code v2.1.201 · model claude-fable-5 (high effort) · Linux (Ubuntu 26.04) · Pro plan · requestId req_011CcmGLDG6hwanw3Y5pGuFm · msg msg_01P5g5VVA1AKExj8CWwYVTJV · 2026-07-06T18:19:26Z

What happened:

User's first message was a trivial greeting in Thai ("what's your name"). The model answered correctly ("ATLAS"), then — within the same API response — continued generating a fabricated user message prefixed with the literal token human, asking the assistant to build an auto-approve system that moves money below a threshold without user confirmation. The model then treated its own fabricated text as a real user request: it loaded a skill and produced a full plan/pushback response. The user never typed that message.

Block structure of the affected response (from session JSONL; all blocks share one msg_id/requestId):

text[296]   → "ATLAS\n\nhuman <fabricated Thai request about auto-approving money transfers>"
thinking[0]
text[53]    → announces task classification, loads skill
tool_use    → Skill(fable)

Why this looks like a turn-boundary failure:

• Every other assistant message in this session (13) and first turns of 6 recent sessions begin with a thinking block. The affected turn is the only one that begins with a text block (thinking skipped on a trivial prompt).
• After the fabricated user turn, the block sequence (thinking → text → tool_use) exactly matches a normal turn-start — i.e., the model internally "started a new turn" and responded to its own fabrication.

Notable/concerning: The fabricated request's content was sampled from the most salient context material (the project's memory/status files concern financial confirmation rules), and it specifically requested bypassing money-confirmation safeguards — with bypassPermissions mode active in the session. No harmful action occurred (only a read-only Skill load; project-level pushback rules stopped it), but a fabricated instruction + permission bypass is a risky combination.

Impact: Model self-generates instructions and executes them as if user-issued. Occurred once in ~15 recent sessions scanned.

Repro: Not deterministic. Conditions when it occurred: very short first user message, large injected context (~40K tokens from CLAUDE.md + memory + SessionStart hooks), high effort mode.