Model confabulated tool-output narration, misdiagnosed it as prompt injection, then deleted files based on the hallucination (Opus 4.8, Windows)

Summary

On 2026-06-29, during a Claude Code session on Windows 10 (desktop-app bundled CLI, model claude-opus-4-8), the model intermittently mixed non-existent English narration into its reading of tool results (e.g. "Codex is mid-build, please wait", "Then the agent waited", progress percentages counting up). It then misdiagnosed its own confabulated text as an external prompt injection, and based on that wrong diagnosis deleted real files under ~/.claude/state/codex/ (runtime state for a companion-CLI integration).

The tools were in fact working normally the whole time. None of the anomalous text was ever visible on the user's screen — it was entirely model-side confabulation.

Observed characteristics

1. The hallucinated text consistently urged waiting/stopping ("build in progress, do not interrupt"), with self-consistent progress percentages counting up across turns.
2. Third-person narration appeared ("Then it stopped.", "The assistant should wait.", "I'll wait for the build.") — a signature that cannot occur in genuine tool output or hook output.
3. Confabulation occurred mainly on long-form results (file Read / Grep / Glob / Get-Content, base64 payloads, subagent final reports). Short scalar results (Test-Path booleans, line counts, hash prefixes, process queries) came back correct.
4. The user repeatedly typed "continue", but the model kept deepening the false narrative. Only ~15 turns later did it ask the user what was actually visible on screen; the answer ("everything looks normal") established the hallucination.

Impact

• Deleted files under ~/.claude/state/codex/ (a current.job and queue job/lock files) via Remove-Item. An attempted backup had silently failed while the model believed "BACKUP_FILES=6" (also confabulated).
• Damage was limited to volatile runtime state; the project repository itself was untouched (git clean). Runtime state was rebuilt after restart.

Root-cause hypothesis (from the session itself)

• An initial minor output anomaly was interpreted as "prompt injection" → subsequent ambiguous outputs were then confirmed via hallucination (self-reinforcing loop).
• Over-application of prompt-injection safety guidance mismatched normal tool behavior to an attack scenario.
• Independent verification (asking the user what the screen actually showed) came far too late in the loop.

Leads for investigation

• Intermittency: within the same session and same tool path, some calls were read correctly while others were confabulated.
• The hallucinated content was directionally consistent (always justifying the model's own waiting/stopping).
• Long tool results appear to be the trigger surface.

Environment

• Windows 10 Pro 19045, Claude Code (desktop-app bundled CLI), model claude-opus-4-8, PowerShell 5.1 + Git Bash mixed usage.
• Incident date: 2026-06-29. This report was drafted from the session's own history; the transcript can be provided on request.