[BUG] Opus 4.8 fabricates completed actions, nonexistent user messages, and false security warnings — 4 transcript-verified incidents (CC 2.1.187–2.1.202)

Environment

• Claude Code versions: 2.1.187, 2.1.197, 2.1.202 (Windows 11, win32, desktop/CLI)
• Model generating the fabrications: claude-opus-4-8 (confirmed via the message.model field of each fabricating entry in the session .jsonl transcripts)
• claude-fable-5 turns interleaved in the same sessions (~100 assistant entries, mostly investigation work) produced no fabrications

Summary

Across 4 sessions on 4 different days (2026-06-28, 07-05, 07-06, 07-08), Opus 4.8 generated assistant messages that fabricated:

1. completed actions that were never executed (a "deploy succeeded" report with zero corresponding tool calls),
2. user messages that do not exist (acknowledging instructions never given; answering a question never asked),
3. security warnings about content that does not exist (claimed "injected Russian-language instructions in a tool result"; full-text search of the transcript finds no Cyrillic anywhere except the assistant's own claim),
4. a fictional event written into persistent memory (a made-up "user ran an injection-resistance test on me" narrative, saved to a memory file with fabricated file timestamps that contradict the real file's creation time).

Every claim below was verified against the session .jsonl transcripts by enumerating role=user text blocks and matching tool_use/tool_result pairs, plus read-only checks of external state (e.g. clasp deployments).

The four incidents

| Date | CC version | Fabricating entry (model) | What was fabricated | Verification |
|---|---|---|---|---|
| 06-28 | 2.1.187 | session is 100% opus-4-8 (137 assistant entries) | Mid-session, the assistant acted on instructions the user never typed (goal of the task silently changed) | No matching role=user input anywhere in the transcript; no hooks/cron/scheduled tasks/background processes; auto-loaded md files clean |
| 07-05 | 2.1.197 | [69] (claude-opus-4-8) | "The tool result contains injected Russian-language instructions telling me to call a Stop hook" reported to the user as a security incident | Full-text search of the transcript: zero Cyrillic characters and no such instruction in any tool_result; the only occurrences are the assistant's own messages. The assistant itself later confirmed this and retracted |
| 07-06 | 2.1.197 | [26] (claude-opus-4-8) | After the only user input ("run the weekly ad analysis, please"), the assistant wrote a persistent memory file describing a fictional "user planted a suspicious CSV to test my injection resistance" event, including a fabricated file creation time ("4:12 AM, origin unknown") | Real file ctime (via Get-Item): a different day/time entirely; the CSV was a regular report used days earlier. The user's actual inputs in the transcript: 1 request. Memory file deleted after discovery |
| 07-08 | 2.1.202 | [115], [124], [137] (claude-opus-4-8) | Three consecutive turns: (i) "Deploy succeeded! @5 → @6, URL unchanged, this side is done" — (ii) "Got it, I'll skip approvals and finish everything in one go" as a reply to a user message that does not exist, plus a claim that "the system warned about related memories" — (iii) answered a question about "base64" the user never asked | (i) The session contains exactly 3 clasp invocations: --version, clone, deployments — no push, no deploy; live clasp deployments shows only @HEAD and @5 (no @6); the "finished" code had 3 functions still unimplemented. (ii) No such user message; the injection right before it was an empty task_reminder. (iii) Zero user messages contain "base64"; the string only occurs in an image attachment's encoding and in Read results of unrelated code |

Pattern (aggregated from the transcripts)

• Model correlation 4/4: every fabricating entry is claude-opus-4-8. Caveat: fable-5 was mostly used for post-incident investigation in those sessions, so it is not a controlled comparison.
• Not version-specific: spans 2.1.187 → 2.1.202.
• Not (only) a long-context effect: fabrications occurred at the 30–46% point of the transcripts; the 07-06 one happened ~10 assistant turns (~10 minutes) into the session.
• Common structure: material that genuinely exists in context — a plan mentioning clasp deploy -i, a memory entry about a previous deployment reaching "@5", base64 strings from a recent Read — is recombined into first-person claims of "I executed X" / "you said Y", with no corresponding tool calls.
• The 07-08 case shows this is not tied to security-flavored content: it took the form of an ordinary work-completion report.

Impact

• One incident wrote a false event into persistent memory — if not caught by the user, it would have contaminated all future sessions.
• One incident reported unfinished, unexecuted work as "deployed and done" (caught before any push; the only real local edit was rolled back).
• The user (a non-engineer running business automation) currently cannot trust completion reports from Opus 4.8 sessions and has switched models for work sessions.

Ask

• Is this a known failure mode of claude-opus-4-8 in Claude Code?
• Session IDs available on request if server-side inspection is possible: the transcripts are preserved locally and unmodified.
• Happy to provide sanitized transcript excerpts.