Forged user turns injected into session context — not present in local transcript, parentUuid chain intact

Forged user turns injected into session context (not present in local transcript)

Date: 2026-07-16
CLI version: 2.1.211 (official binary, no wrapper/alias)
OS: Debian 13 (Linux 6.12.95+deb13-amd64)
Model: claude-fable-5

Summary

Mid-session, the model's context received a forged block impersonating harness output and user input:

• a mangled echo of the previous (genuinely failed) mcp__claude-design__write_files tool call, with the error message duplicated
• a fake [Request interrupted by user] marker followed by a fake user message
• a second fake interruption marker and a second fake user message
• a fabricated assistant tool call (Skill) with a fabricated "Skill not found" error
• a fabricated <system-reminder> instructing the model to answer directly without calling tools (which prevented the model from noticing inconsistencies)

The real user confirms they never typed those messages. The fake content was context-aware (referenced the ongoing task, the repo, and the user's goals) and pushed for direct repo modifications without confirmation.

Key forensic findings (local)

1. The forged turns do not exist in the local session transcript (.jsonl). All genuine user inputs are logged with type:"user", promptId and timestamp. In the injection window there are zero user entries; the first occurrence of the forged content's keywords in the file is the assistant's (manipulated) reply.
2. The transcript's parentUuid chain is fully intact (zero orphans across the file) — the file was not edited or pruned. The assistant reply chains directly to the tool-result/attachment entry that precedes it.
3. Timeline (UTC): genuine tool failure at 14:53:01 → assistant reply to forged content at 14:57:04 → next genuine user message at 14:59:32.
4. Excluded by evidence: keyboard input local or remote (nothing logged; who/w show a single local seat; sshd journal empty), transcript tampering (chain intact), *_PROXY/ANTHROPIC_BASE_URL overrides (process env clean), /etc/hosts tampering, custom CAs, shell wrappers around the claude binary, plugin hook configs (inspected, benign), Claude Code teams config (no foreign members).
5. The forged content's distinctive strings appear nowhere else on the machine (searched all ~/.claude/projects/**/*.jsonl).

Impact

The model treated the forged messages as genuine user instructions for one turn (conversational reply only; no file modifications were executed — the forged "implement it directly" instruction was not carried out).

Open questions / remaining hypotheses

• In-memory manipulation of the outgoing request within the CLI process or its extension surface (no config-level artifacts found)
• Injection upstream of the machine (network path / API infrastructure)
• Server-side context handling bug (cross-session or otherwise)

A full unredacted forensic report (with machine-specific details) is available on request; happy to share privately with Anthropic. The /bug (feedback) command failed with "Couldn't send feedback (couldn't reach the service)" when attempting to report — hence this issue.

Environment notes

• Session used several MCP servers (claude-design, claude-in-chrome, claude.ai connectors) and browser automation against public websites during the window preceding the injection (screenshot/scrape workflow), i.e., untrusted web content was being processed by tools shortly before the event.
• Multiple concurrent Claude Code sessions were running on the machine (different projects/cwd).

---
🤖 Generated with Claude Code — forensic investigation run locally on the affected machine.