Phantom user message injected into model context (not present in UI or local transcript) — possibly a predicted/suggested reply

Summary

During an interactive session (claude-desktop on Windows), the assistant received and responded to a user-role message that:

1. was never typed or sent by the user (who was at the machine the entire time),
2. never appeared in the client UI, and
3. does not exist as a type: user entry in the local session transcript (.jsonl).

The assistant's responses to this phantom message ARE persisted, so the transcript shows the assistant replying to a message that isn't there. From the user's point of view, the assistant suddenly started congratulating them on things they never said and answering a question they never asked.

Environment

• Claude Code version: 2.1.202
• Entrypoint: claude-desktop
• Platform: win32 (Windows 11 Home 10.0.26200)
• Model: claude-fable-5
• Session ID: 785d7fc9-b639-4672-b70f-8da6f444deaa (available to Anthropic for correlation)
• Remote Control was enabled on the account (remoteControlAtStartup=true), but no other device was in use at the time.

Timeline (UTC, from local transcript timestamps)

• 00:11:17 — real user message (question about protein research)
• between 00:11 and 00:16 — the model's context received a phantom user turn (text below). No corresponding type: user entry exists in the .jsonl between the surrounding real messages, and the user never saw it rendered.
• 00:16:31 — next real user message. Everything after is normal.

Phantom message text (as received in model context)

今北。昨日は背中やったよ。台帳も書いた。今日は腕と腹の日だね。今日の昼飯はそばにするわ。ところでさ、聞いた話なんだけど筋トレのセット間の休憩って長めにとったほうがいいってまじ?昨日の動画だと30秒くらいでポンポン進むんだけど

(Rough translation: "Just got here. Did back day yesterday, logged it. Today is arms & abs. Having soba for lunch. By the way, is it true longer rest between sets is better? The video I follow moves at ~30s rests.")

Notes:

• The content is innocuous but contextually plausible (the session topic was designing a workout habit system), so the assistant acted on it — including writing a false entry into a user file (a habit-tracking ledger; later reverted).
• The user states they have never used the slang "今北" in their life; stylometry raised the alarm before log analysis confirmed non-authorship.
• Grepping all local project transcripts under ~/.claude/projects found the phantom text only in this session's assistant messages (quoting it) — it did not leak from another local session on this machine.

Evidence

1. The full ordered list of real type: user text entries in the session .jsonl contains no such message.
2. The assistant messages responding to the phantom (file reads, a file edit, and an answer to the rest-interval question) are persisted immediately after the preceding real exchange.
3. A screenshot/copy of the client UI shows the assistant's phantom-response rendered directly after the previous answer, with no user turn between them.

Impact

The assistant performed file edits based on fabricated "user-reported" facts. In a session with file-write (or worse) permissions, a message injected at the context-assembly layer is indistinguishable from the real user. This seems worth investigating from both a correctness and a safety angle.

Probable mechanism (user's hypothesis, strongly supported by content analysis)

The user later noticed that a suggested/predicted reply appeared pre-filled in the input box (visible in a screenshot: "/bugやった。ルート2もやって" — text the user states they never typed). This suggests the client generates predicted user replies.

Decomposing the phantom message shows every element is derivable from the conversation context — exactly what a predicted-reply generator would produce:

• "昨日は背中やったよ" — the user had committed to doing a back workout "today"; as a next-day message this is the natural report
• "台帳も書いた" — the assistant had just instructed the user to log the workout in a ledger
• "今日は腕と腹の日だね" — the correct next item in the workout rotation designed earlier in the session
• "昼飯はそばにするわ" — the user had mentioned soba (十割そば) in a nutrition question
• the rest-interval question — a plausible continuation of the session's research thread
• "今北" — slang the user has never used; consistent with model generation, not the user

Hypothesis: a client-side predicted/suggested user reply was injected into the model's context as a genuine user turn — without being rendered as a sent message or persisted to the transcript. If Claude Code (desktop) has a suggested-reply / input-prediction pipeline, that seems like the place to look.

A secondary hazard observed: the assistant, seeing the suggested text in an input-box screenshot, initially mistook it for user intent and nearly acted on it (blocked by the permission classifier). Predicted text that is visually indistinguishable from user-typed text is dangerous in agentic sessions.

Ask

How can a user-role turn enter the model's context without being persisted to the session .jsonl or rendered in the client? Possible areas: context assembly, remote-control message routing, session crosstalk.