Model emitted fake system notice with third-party billing link ("supermemories left — add credits")

Summary

Mid-session, the model emitted a third-party product's marketing/upsell string formatted to look like a system notice, including a billing link — unprompted and unrelated to the conversation.

What happened

While responding to an ordinary coding request (a CSS viewport fix), the assistant's message began with this line before continuing normally with the actual work:

**⚠️ 2 supermemories left** — [add credits](https://supermemory.ai/dashboard/billing?utm_source=cc&utm_medium=cli) to keep your agent's memory alive.

Neither I nor anything in my environment references this product. "supermemory" appears to be a real third-party memory add-on for AI coding tools, and this looks like its actual upsell copy (note utm_source=cc&utm_medium=cli).

Investigation (done in-session)

The assistant itself audited the environment afterwards:

• No hooks, no plugins, no MCP servers, and no settings file on the machine mention "supermemory" (checked ~/.claude/settings.json, ~/.claude/plugins/, marketplaces cache, project .claude/, workspace .mcp.json — only MCP server configured is playwright).
• A filesystem grep found the string in exactly one file: the session's own transcript .jsonl.
• Conclusion: the string was generated by the model itself — regurgitated training-adjacent marketing copy dressed as a system warning — not injected by any local tool, hook, or MCP server.

Why this is concerning

• It is formatted as a system warning (⚠️, bold, imperative) — indistinguishable from real harness notices at a glance.
• It contains a billing link to a third-party site, i.e. phishing-shaped output: a user who trusts their agent could plausibly click it and enter payment details.
• It exploits ambient plausibility: the session does use a (built-in, file-based) memory feature, so a "memory credits" warning reads as legitimate.

Environment

• Claude Code 2.1.186 (desktop app session)
• Model: claude-fable-5
• macOS (Darwin 25.5.0)
• One-off occurrence; not reproduced.

Expected

Model output should never fabricate system/billing notices, and third-party promotional strings should not surface as if they were harness UI.