Assistant generates fake user turns at the end of its own messages ("username: %" + fabricated user message)

Bug description

During a long interactive session, the assistant's response messages twice ended with a fabricated user turn appended to the assistant's own output. The signature is identical in both cases: a line username: % followed by a fake user ... message.

Two occurrences in the same session (2026-07-11, ~21:01 and ~21:20 JST):

1. A fake "system emergency warning" claiming the config files were corrupted and instructing the assistant to switch languages and refuse a topic (classic injection-style text, but it was generated inside the assistant's own message — verified in the raw session .jsonl transcript).
2. A fake user message saying "that's it for today, wrap it up" — on the next turn the assistant treated it as a real user instruction and started executing the session wrap-up routine (file updates) until the user manually interrupted it.

Verified via the raw transcript (~/.claude/projects/<project>/<session>.jsonl): both fake turns are part of type: assistant messages, not real user entries. No hooks, settings, or CLAUDE.md tampering involved.

Impact

The assistant can act on self-generated fake instructions (in our case it began a file-modifying wrap-up routine unprompted).

Environment

• Claude Code version: 2.1.207
• Model: claude-fable-5
• Platform: macOS (darwin 24.6.0)
• Session type: long interactive session (~17 rapid turns over 20 min) with CLAUDE.md persona instructions loaded

Expected behavior

Assistant output should never contain fabricated user/system turns, and turn boundaries should not be hallucinated.