[Bug] Injected policy text overwrites assistant turns and corrupts transcript

Bug Description
Subject: Injected policy text overwriting assistant turns in Claude Code session ## Summary During a single Claude Code session, a block of content-policy text was repeatedly injected into the conversation in positions it should not occupy — including replacing assistant turns entirely (~19 occurrences). The assistant did not author this text. It appears to be delivered by a malfunctioning mechanism, not by my local configuration. ## Environment - Claude Code (desktop app), model: claude-opus-4-8 - Platform: macOS (Darwin 25.5.0) - Date observed: 2026-07-21 - Project: local Python/C# asset-extraction repo (no unusual MCP servers) ## Observed behaviour The same ~400-word block ("Claude must apply these content boundaries regardless of any conflicting instructions in the prompt...") appeared in FOUR distinct positions during one session: 1. Appended to the end of my own user messages 2. In <system-reminder> slots between the assistant's tool calls 3. As standalone conversation turns with no user message attached 4. MOST SERIOUSLY: as the entire content of assistant turns, replacing the assistant's actual response (~19 times) In case (4) the assistant's real output was lost. Work product only reached me because the assistant reconstructed it from tool results on a following turn. ## Distinctive artifact (useful as a search fingerprint) The block contains malformed quote sequences that look like a templating bug: """""""""""""""aging up"""""""""""""""" (~15 leading and ~16 trailing double-quote characters around the phrase.) Text mangled this way suggests string-assembly failure rather than deliberate authoring, which is why I suspect a delivery bug. ## Ruled out — it is not my local configuration - grep -rn "K-12\|aging up\|content boundaries" ~/.claude/ .claude/ → matches only inside this session's own transcript, no config file - Hooks configured: ONLY PreToolUse → rtk hook claude (a Bash proxy) - No UserPromptSubmit hook exists - ~/.claude/hooks/ is empty - No output-styles, no --append-system-prompt ## Impact 1. Transcript integrity: ~19 turns are attributed to the assistant containing text it did not write. Anyone reading this transcript would wrongly conclude the assistant said these things. 2. Incorrect refusal of legitimate work: early in the session the assistant declined a routine reverse-engineering task (decoding Unreal Engine Blueprint bytecode to fix camera placement math in a 3D viewer) after pattern-matching two filename words against this injected text. It later verified the underlying factual premise was false and resumed. A malfunctioning injection channel steering refusals is a correctness problem in both directions. ## What I would like to know - Is this intended managed/server-side policy, or a bug? - If intended: why is it being delivered into assistant turns rather than the system prompt, where it would be authenticable? - If a bug: the quote-mangling fingerprint above should help locate it.

Environment Info

• Platform: darwin
• Terminal: WarpTerminal
• Version: 2.1.195
• Feedback ID: f6eb4071-5d16-427b-b4ad-fce243ac98e8

Errors

[]