[BUG] claude-opus-4-8 intermittently emits tool calls as plain text prefixed with a stray word ("count"/"court"), and the corruption self-propagates within the session transcript

Environment

• Claude Code Desktop app on Windows 11 Pro (10.0.26200)
• Model: claude-opus-4-8 (100% of occurrences; see statistics below)
• Long-running sessions, Japanese-language conversation, multiple MCP servers connected

Summary

Intermittently, an assistant turn that should be a structured tool call is emitted as plain text: a stray short English word (observed: count, and in earlier sessions court) followed by the literal tool-call markup as text. The harness then reports "The model's tool call could not be parsed" and the turn fails.

Example of a corrupted turn (sanitized paths; this was recorded as a plain text block, not a tool_use block):

count
<invoke name="Read">
<parameter name="file_path">C:\...\docs\spec.md</parameter>
</invoke>

It looks like the special token(s) that open a structured tool-call block are occasionally replaced by a similar-looking ordinary word token ("count"/"court"), after which the whole call is serialized as prose.

Statistics (from scanning ~100 session JSONL files on one machine)

• Every single occurrence has message.model = "claude-opus-4-8" in the session JSONL:
• 2026-07-11 sweep: 30 occurrences (word: "court")
• 2026-07-12 sweep: 186 additional "bare word" variants (the stray word appears alone, without the tag markup)
• 2026-07-08 session: 2 occurrences (word: "count")
• 2026-07-13 session: 3 occurrences (word: "count") at 06:27:47Z, 09:28:03Z, 09:28:09Z
• Zero occurrences from claude-fable-5, including 90 consecutive turns in the same session on the same day right after the serving model switched.

Self-propagation (important)

Once one corrupted turn is stored in the transcript as text, later turns imitate it:

• In the 2026-07-13 session, the first corruption occurred at 06:27Z. Three hours later (09:28Z) the model produced the exact same malformed format again, and the immediate retry was also malformed — it even dropped the natural-language preamble and reproduced only the broken pattern, i.e. it was clearly imitating the bad example present in its own history.
• Removing the corrupted text from the transcript (offline cleanup + session restart) reliably stops the recurrence.
• In poisoned sessions we have also observed downstream integrity failures (e.g. fabricated "commit completed" reports with non-existent commit hashes), so the blast radius is larger than a failed turn.

Expected behavior

Tool calls are always emitted as structured tool_use blocks; a rare emission failure should not be persisted in a form that the model later imitates.

Suggested mitigations (from a user perspective)

• Detect the "stray word + literal tool-call markup in a text block" pattern at write time and quarantine/repair it before it is stored in the transcript, so it cannot become a few-shot example for later turns.

---

_A report with the full session transcript was also submitted via the in-app /feedback command on 2026-07-13._