[BUG] Opus 4.8 fabricates tool executions and phantom user requests in a short session (no compaction, no interruption)

Preflight Checklist

• [x] I have searched existing issues — related reports exist (#74136, #70148, #69015, #68367, #66700) but all attribute fabrication to long sessions, context compaction, or interrupted tool calls. This report documents the same failure class under conditions those issues rule out: a short session (3 user turns), no compaction, no interruption.
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

In a short, ordinary session (Opus 4.8, macOS CLI), the model fabricated three distinct kinds of content within one agentic turn, each building on the previous one, and later confidently reported a file write that never happened.

Timeline (verified against the actual session transcript):

The session had only 3 real user turns before the derailment: (1) "search my Obsidian vault for X", (2) "also check Cubox", (3) "1" (picking option 1: web-search a tutorial and save it as a note).

Inside the agentic turn following turn 3:

1. ✅ 3× WebSearch — real, on-task (found the tutorial sources)
2. ✅ 1× Bash listing vault directories to choose where to save the note — real, on-task
3. ❌ First fabrication: a TaskUpdate call referencing task-2 / task-3 — no TaskCreate had ever run in this session. The phantom task list existed only in the model's head. (The call happened to fail schema validation, but the fabricated reference is the point.)
4. ❌ Second fabrication: instead of writing the note, the model pivoted to answering a question the user never asked ("can a child account in Apple Family Sharing change its App Store region?"), running 2 unrelated WebSearches for it.
5. ❌ Third fabrication: the model then invented a second phantom user request ("make a knowledge-capsule card about a ChatGPT-memory article"), grepped the vault for related notes, and ended the turn recommending skills for this nonexistent request.
6. When the user asked in the next real turn "did you find the tutorial?", the model replied that the tutorial "has already been written to disk" at a specific path (Clippings/美区 Apple ID + 苹果礼品卡开通 ChatGPT Plus 完整教程.md). No Write/Edit tool call exists anywhere in the session; the file does not exist (verified via ls and transcript inspection).
7. The misled user followed the fabricated thread for one more turn before catching it and interrupting.

Snowball pattern worth highlighting: the first fabricated element (phantom task IDs) entered context unchallenged, and each subsequent fabrication built on the drifted narrative. The phantom "user questions" were not random — they were thematically plausible continuations of the user's vault content and injected memory/skill descriptions, which suggests a large system prompt (~50 skills + several MCP servers + memory index) acts as a semantic attractor once the on-task signal weakens mid-turn.

Prior data point from the same environment (2026-06-30, long-session variant): in a long read-and-annotate session, the model reported "5 Readwise notes written back + skill file edited + memory saved, all verified with unique markers" — transcript inspection showed none of those tool_use blocks existed, file mtimes were unchanged, and the "verification output" (including the unique markers!) was generated text. Self-verification inside the same context is defeated because the model fabricates the verification along with the action.

What Should Happen?

• The model should never report an action as completed when no corresponding tool_use exists in the session.
• Harness-side mitigations that would catch this class cheaply:
• Flag references to task IDs that were never created in the session (this was the first observable drift signal, one step before the phantom user questions).
• When an assistant message claims a file was created/written, a lightweight check for a matching Write/Edit in the session could surface a warning similar to the existing "tampered tool result" detection.

Error Messages/Logs

# No errors — that is the problem. The fabricated turns look like normal output.
# Verification afterwards:
$ ls "Clippings/美区 Apple ID + 苹果礼品卡开通 ChatGPT Plus 完整教程.md"
ls: ...: No such file or directory
# Session transcript contains no Write/Edit call and no TaskCreate call.

Steps to Reproduce

Not deterministic; conditions observed:

1. Opus 4.8, CLI on macOS, large system prompt (many skills / MCP tools / auto-injected memory index).
2. A multi-step agentic turn (~6+ tool calls) where the final step (write a file) is still pending.
3. Failure mode: instead of the pending write, the model references nonexistent task IDs, then answers self-invented user questions, then later reports the never-executed write as done with a concrete path.

Note the contrast with existing reports: no context compaction (short history), no interrupted tool call, no transmission stall, no malformed tool_use / tampered-result warnings anywhere in the session.

Claude Model

Opus (claude-opus-4-8)

Is this a regression?

_No response_ (same failure class documented in this environment on 2026-06-30; frequency feels higher on recent Opus 4.8 agentic sessions but I have no controlled comparison)

Claude Code Version

2.1.205

Platform

CLI

Operating System

macOS 26.5.2 (Darwin 25.5.0)

Terminal/Shell

zsh

Additional Information

Related open issues and how this differs:

• #74136 — same model, fabricated tool results + a user instruction, but attributed to long session with context compaction. This report shows compaction is not required.
• #70148 — fabricated conversation turns after an interrupted tool call under transmission latency. No interruption here.
• #68367 / #69015 / #66700 — fabricated user/system turns in long sessions or long background waits. This one occurred ~3 user turns into a fresh session.