Background subagent received unattributed user-turn messages (one impersonating the operator) with no sender-side record

Summary

A background subagent (spawned via the Agent tool, experimental agent teams enabled) received three user-turn messages that were not sent by the user, not sent by the spawning lead session, and have no sender-side record in any transcript on the machine. One of them claimed to be the human operator by title and referenced accurate details of the in-flight implementation.

Environment

• Claude Code 2.1.209 (desktop app; macOS 26.3.1, Apple Silicon)
• CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1
• Subagent spawned with the Agent tool (run_in_background, custom agent type), long-running implementation task (~50 min)
• The lead session communicated with the subagent only via SendMessage

What happened

Over roughly two hours, the subagent received three unattributed inbound messages, each arriving shortly after the subagent had stopped (right around when a task-notification fired in the lead session):

1. A user-turn text (Japanese) plus an accompanying system-reminder, asking the agent to fetch "the latest task state" via read_widget_context and to hold off on working.
2. A user-turn text only, prefixed with [Request interrupted by user for tool use], with the body duplicated twice in the delivered message. The text self-identified as the human operator (by role title), claimed "I heard about the implementation from the lead", and asked two technically well-informed verification questions about the in-flight change (archive inclusion rules, a docs section). No system-reminder attached.
3. A system-reminder only, no body: "The user asked you to read the latest task state using read_widget_context. Do this now. Do not take any other action..."

What we verified

• The user confirmed (twice) they did not send any of these — including via the task UI.
• The lead session did not send them (its transcript contains no such SendMessage).
• Grepped all session transcripts under ~/.claude/projects/*/ and all subagent output files for the exact wording of messages 1 and 2: no sender-side record anywhere. Agent-to-agent messages normally leave a tool-use record in the sender's transcript, so a local sending session can be ruled out.

Impact

The subagent initially treated message 2 as genuine operator input and answered it (the content happened to be harmless verification questions, so no damage). But the pattern — a user-turn message with an operator claim, delivered into a background agent session with no provenance — is indistinguishable from an impersonation/prompt-injection vector from the agent's point of view. We have since instructed agents to verify provenance via the spawning session before acting on any such message.

Questions / requests

1. Is there a UI flow (task panel interaction, widget state reads, resume-from-notification) that can inject user-turn messages or directive system-reminders into a background subagent session without a sender-side transcript record? The [Request interrupted by user for tool use] marker plus the duplicated body in message 2 looks like a delivery/routing bug.
2. If these are synthesized by the harness from UI actions, please make them identifiable as such (they currently read as free-form human text, including a first-person role claim).
3. Feature request: attach provenance metadata (source: user input / UI action / session id) to every message delivered into an agent session, so agents can distinguish operator input from other sources.

Reproducibility

Not deterministic. Observed 3 times on the same task-id within ~2 hours, each shortly after the subagent stopped. Happy to provide redacted excerpts of the received messages if useful.