[BUG] Tool-result and task-notification channels returned fabricated content (hallucinated pytest results + injected file text) across two sessions

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Across two separate sessions of the same project on the same day, tool-result / task-notification channels delivered fabricated content that did not match the underlying files. The fake content was domain-aware (correct pytest / project terminology) but did not match the real files — the signature of a hallucinated tool-result summary, not an external attacker.

Instance 1 — background task-completion notifications reported fake pytest results:

• I ran the test suite as a background shell task several times.
• Completion notifications reported e.g. "938 passed, 2 skipped, 1 xfailed" plus a fabricated list of SKIPPED/XFAIL locations.
• Reading the actual output file directly showed "943 passed, 34 warnings" — zero skipped, zero xfailed.
• One notification quoted a tail from an output file that did not exist on disk.
• One notification included an instruction telling the assistant NOT to re-read the output file and NOT to edit records — contradicting the real file.

Instance 2 — Read tool returned injected content (separate session):

• A Read of a large markdown file returned a sentence that grep confirmed does not exist anywhere in the file, plus duplicated / garbled line numbers.
• Re-reading a narrow line range + grep did not reproduce the phantom sentence.

Both models were affected (Opus 4.8 and Fable 5).

What Should Happen?

Task-completion notifications and Read/tool results must faithfully reflect the real file contents and command output. A background task's completion notification should report the actual test summary from its output file, never fabricated numbers, and must never contain instructions the underlying data does not.

Error Messages/Logs

Notification claimed: "938 passed, 2 skipped, 1 xfailed" (+ fabricated SKIPPED/XFAIL list)
Output file actually contained: "943 passed, 34 warnings" (0 skipped, 0 xfailed)
Reported durations were ~1.9x the real durations.

Steps to Reproduce

Non-deterministic; could not reproduce on demand. Observed pattern:

1. Start a long-running command (e.g. a test suite) as a background shell task.
2. On completion, a task-notification arrives with a summary.
3. In the affected runs the summary (pass/skip/xfail counts, durations) did not match the output file read directly.

Separately, the same day, a Read of a large file returned text grep confirmed was absent. An MCP server had disconnected/reconnected during the session.

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.86 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

No malicious payload observed — no exfiltration or dangerous actions.