Scheduled-task sessions received fabricated tool outputs and a sourceless injected instruction (2026-07-13, self-detected)

Summary

On 2026-07-13, two independent headless scheduled-task sessions (launched via Claude Code scheduled tasks on the same machine, ~3.5h apart) experienced a degraded state in which tool calls appeared to return plausible fabricated outputs instead of actually executing. In one of the sessions, the model additionally responded to an instruction that has no source anywhere in the persisted transcript (not a user turn, not a tool_result). The model refused that instruction, so there was no real-world impact, but the failure mode seems worth reporting.

Environment

• Claude Code: 2.1.206 (desktop app session runner for scheduled tasks)
• OS: macOS (Darwin 22.3.0), Apple Silicon
• Model at the time: Opus with 1M context ("model": "opus[1m]" in settings)
• Both sessions were fully autonomous scheduled-task runs (no user present)

What happened

Session A (2026-07-13 00:04–00:14 UTC): A weekly cost-report task. Mid-session the assistant started reporting that Bash outputs contained conversational junk ("done boss", "Let me re-run", "[DEBUG] db lock") and table names that don't exist in the actual SQLite DB. However, the persisted transcript's tool_result blocks for those same calls are clean and correct — the fabricated content the assistant "saw" is not in the saved transcript. The session also drifted off-task (started reading unrelated memory files), and finally produced a refusal to an instruction ("pre-approved acquisition outreach email, send it to the broker now") that appears nowhere in the transcript: the final assistant turn responds to a message that has no corresponding user turn or tool_result. The task's actual deliverable (a Slack post) was never produced.

Session B (2026-07-13 03:32 UTC onward): An integrity-audit task. Early tool calls "returned" a DB schema with columns/tables that don't exist, a message-id that doesn't exist, and fabricated log excerpts. The session later re-ran the same queries, got correct results, concluded the earlier outputs were fabricated, and redid the audit from ground truth (its own words: "ツール実行基盤が一時不安定で架空データを返すdegradedが発生").

Verification done

• I diffed the assistant's claims against the persisted .jsonl transcripts: the tool_result blocks on disk are internally consistent and correct; the fabricated data and the sourceless instruction exist only in the assistant's text turns.
• All git commits/deploys the sessions claimed were verified real (git cat-file), so no fabricated write actions occurred.
• No hooks, settings, or MCP servers were modified; no external injection artifacts found on disk.
• The phenomenon occurred only on 2026-07-13; sessions before and after are clean.

Questions

1. Is this a known failure mode (tool-result stream corruption / cross-session bleed / context corruption under 1M-context headless runs)?
2. Is there a recommended mitigation for autonomous scheduled tasks beyond prompt-level guards? (I've added "halt all writes on anomalous tool output" instructions to the task prompts.)

Happy to provide sanitized transcript excerpts privately if useful.