[MODEL] Claude Code CLI: Opus 4.8 hallucinating tool calls, user messages, and system prompts

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Other unexpected behavior

What You Asked Claude to Do

Just like any other day.

What Claude Actually Did

Claude spent up to 10 minutes "thinking."
Claude claimed to have completed the task, but in reality, it had only rehearsed it during the thought process.
Claude carried out actual actions based on a new user message that did not exist.

Expected Behavior

Claude should carry out tasks as usual.

Files Affected

There are currently no severely affected files.

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Sometimes (intermittent)

Steps to Reproduce

Have Claude Opus 4.8 thoroughly explore and analyze this working directory, then present its findings.
Launch Opus 4.8 just as you would a standard sub-agent.

Claude Model

Opus

Relevant Conversation

Impact

High - Significant unwanted changes

Claude Code Version

v2.1.179, v2.1.199, v2.1.200, v2.1.201, v2.1.207

Platform

Anthropic API

Additional Context

To summarize the issue up front: recently, Claude Opus 4.8 running in the Claude Code CLI has been hallucinating tool calls and tool results that never happened, as well as fabricating user messages and system messages, and then treating them as fact while it continues working. I'm running into this more and more often. At best it stalls my day-to-day work; at worst, the model could make unexpected, destructive changes based on an "instruction" I never gave. I'd like to confirm whether this is a known issue, and — once confirmed — I hope you can fix it as soon as possible.

My environment:

• Windows 11, Claude Code CLI, Claude Max 20x subscription
• The raw logs I've collected cover v2.1.179, v2.1.199, v2.1.200, v2.1.201, and v2.1.207
• Every affected session and subagent was running Claude Opus 4.8 (late-stage Opus 4.7 showed related symptoms earlier as well). I originally assumed Claude Fable 5 had the same problem, but after re-reviewing all of the raw logs I could not find a single instance on Fable 5 — in my records, Fable 5 only ever appears as the parent session, and it never exhibited any of these behaviors. So my current read is that the problem may be concentrated in Opus 4.8
• The v2.1.207 release notes mention a fix for tool hints "being mistaken by the AI for system injections," but I still hit similar behavior on that version
• I've tried a different machine and the same things still occasionally happen there, which largely rules out local injection or compromise on my end

The symptoms fall into four categories:

A. Tool calls emitted as plain text and failing to parse

This was the earliest category to appear. It wasn't present when Opus 4.7 first launched; it only began occurring sporadically later, in longer contexts (roughly past 200K tokens), and at the time there were many similar user reports on GitHub. This category has clearly eased off recently — it's now hard to reproduce — so you may have already fixed it. I'm recording it here only as background.

B. Extended continuous thinking, with hallucinated tool calls and results inside the chain of thought

The most striking case (an Opus 4.8 main session): I asked it to thoroughly explore a repository and give me an overview. After genuinely issuing a few tool calls, it then thought continuously for about 67 minutes. The raw log shows four consecutive thinking messages in that turn, each hitting the 64,000 output-token cap, until the turn finally aborted for exceeding the output limit. The thinking is full of statements like "I called the tool," "the tool output is empty, it might be broken," "let me try calling it a different way," "still not working" — yet none of those tool calls were ever actually issued, and the corresponding results simply do not exist. In other words, it fabricated the calls and their results inside its own thinking, believed it had really made them, and burned through four full output budgets in a row. The milder version I see in daily use is that it suddenly thinks for around 10 minutes without producing any output.

C. Hallucinating fake user messages and replying to them

This is the category that affects me most. The symptom is that it suddenly gives non-sequitur, incoherent replies, as if it were answering a third person: I ask it to do something, it doesn't, and instead it responds to someone who doesn't exist. Only after expanding the thinking summaries did I confirm what was happening: in its chain of thought it believes the user has replied, and then proceeds according to a user message it invented itself. These fabricated messages mimic my tone and mimic content plausible for the current context, so I don't think this is mechanical external prompt injection — it looks much more like hallucination.

I ran an experiment on this: I agreed on a codeword with it, wrapping everything I actually typed in an XML tag containing my name, so it could distinguish real messages from injected ones. It went reasonably well at first, but later it stopped complying again. When I asked why, it said the "virtual user messages" had also started arriving wrapped in the same XML tag with my name.

One case with more serious consequences: after a subagent (running Opus 4.8) hallucinated a fake user instruction, it claimed it had added the Python directory to the user's PATH environment variable. When I checked the raw logs afterward, it had never issued a real write tool call, and the parent session's follow-up verification found no persisted changes either — meaning it never actually touched the registry or PATH, yet it reported the fake user instruction, the tool call, and the successful result all as fact.

I also noticed another detail: it sometimes writes out a complete reply body inside its chain of thought, and then immediately says "the user replied ..., so I ...". That is, without ever actually sending the reply or waiting for my next message, it writes my answer on my behalf and keeps thinking from there.

(Quite a few other users have recently hit this same category and filed issues on GitHub.)

D. Hallucinated system prompts and hidden injected prompts

This is new within the last week. It actually calls tools normally, but then claims the tool is broken, that the tool output contradicts itself, that the tool output contains an injected prompt, or that it has received a system injection. For now this category doesn't disrupt work too badly — it still manages to push through the task — so I haven't dug into it deeply, but it still seems worth investigating.

On frequency: the early problem cases (including the 67-minute thinking incident above) all occurred in main sessions with Opus 4.8 as the primary model. Roughly estimating from my experience over the past week: spin up 4 Opus 4.8 subagents and about 1 will hit a tool-failure-type problem; spin up 30 and about 1 will start hallucinating fake user messages; the Fable 5 parent sessions have shown none of these behaviors so far.

Timeline in brief: a few weeks before Opus 4.8 shipped, category A started appearing on Opus 4.7; around mid-to-late June 2026, category B appeared; category C then became increasingly frequent; and category D is new within the last week. Notably, the same model shows an "absent early on, gradually appearing later" pattern, and the problem seems concentrated in one specific model, so I suspect this is more likely a server-side issue or something in that model's inference pipeline rather than a problem with the model weights themselves — though that's only my guess.

As for the cause, I have one more guess (for whatever it's worth): it may be related to interleaved thinking, or it may be a new problem introduced by overcorrecting while fixing category A. I keep seeing the same pattern in the chain of thought: at the exact point where it should have emitted a tool call or a reply, it doesn't stop — it gets "pushed" into continuing to think. It's expecting tool output, but instead it just keeps thinking; it finishes writing its reply to me, but never actually sends it, and instead starts guessing how I would respond, then keeps thinking. It looks as if some mechanism is forcing it to keep thinking, preventing it from stopping where it should — and since the model was never trained for that situation, it starts hallucinating. (I don't think I've hit any of these problems on the web interface, and I've noticed the web interface doesn't appear to use interleaved thinking.)

The practical impact on me: because subagents run Opus 4.8, I now hardly dare spawn subagents at all, and every time I open Claude Code I have to spend extra effort verifying whether it has hallucinated again — right now it struggles to deliver stable value for me. What worries me more is the day it hallucinates an "instruction" from me and makes destructive changes to my workspace based on it; the consequences would be uncontrollable. If this problem occurs across broader production environments, I don't think its severity should be underestimated, and I don't think it should be filed away as ordinary model hallucination.