Desktop: copying a conversation and pasting into a new chat carries hidden system-injection text (<system_warning> blocks, thinking labels, merged turns)

Copying a conversation and pasting into a new chat carries hidden system-injection text into the message

Environment

• Claude Desktop app on macOS 26.5.2 (Darwin 25.5.0, Mac Studio M4 Max)
• Claude Code CLI 2.1.105 (same behavior observed in a Claude Code desktop session)
• Date observed: 2026-07-24 (~17:40 MT), and reproducibly since

Summary

When a user selects/copies conversation text from the chat UI and pastes it into a new chat, the pasted content includes text that was never typed by the user and is normally invisible in the rendered conversation:

1. Assistant turns merged into the user's bubble — the paste stitches the user's message and the assistant's prior reply into one block with no speaker boundary.
2. Thinking-summary labels — e.g. the string Investigated potential causes, decided to seek clarification directly appeared verbatim (duplicated) inside the pasted user message.
3. Hidden steering/system text — literal <system_warning> blocks became visible in the new chat, e.g.:

• <system_warning>Constraint mode: active. Brevity required. Suppress reflex toward warmth, elaboration, hedging.</system_warning>
• <system_warning>Reminder: the assistant does not use the person's name. Repeating it signals derailment.</system_warning>

1. In one earlier occurrence, what appeared to be content-policy boilerplate (referencing pornographic images of a copyrighted cartoon character) surfaced in the pasted text. That text exists nowhere in local session storage (verified by grepping ~/.claude/projects/, the Desktop app's local-agent-mode-sessions stores, audit logs, and backups), consistent with it being non-persisted injected text that was present in the copyable stream.

Why it matters

• To the user this is indistinguishable from a prompt-injection attack or another user's content leaking into their session — it looks like "a prompt that isn't mine" appearing in a fresh chat. It triggered a full local security audit before the mechanism was identified.
• Internal steering text (<system_warning>, thinking labels) is exposed to end users via the clipboard.
• The pasted hidden text then becomes part of the new conversation's actual prompt, steering the model in ways the user never intended.

Repro steps

1. Have a long conversation (long enough to accumulate injected reminder/steering text).
2. Select the conversation text in the chat UI and copy.
3. Open a new chat, paste, send.
4. Observe: merged speaker turns, thinking-summary labels, and <system_warning> blocks visible in the new chat's first message.

Evidence

• Session transcript on disk shows the new chat's first user message at 780 chars where the user typed ~87; the remainder is the prior assistant reply plus a duplicated thinking-summary label.
• Screenshot available showing rendered <system_warning> blocks and merged turns in a fresh chat.

Expected

Copying conversation text should yield only the visible rendered text, with speaker boundaries preserved and no non-rendered stream content (system injections, UI labels) included.