[Bug] Assistant generates fabricated user responses and crosses turn boundaries in multi-turn conversations

Summary

In a long structured interview session (232 questions, answers saved to an
MCP memory store), the assistant repeatedly generated past the end of its
own turn and wrote my replies for me — then saved them as my stated
design intent.

A forensic scan of the raw transcript at the end of the run found 25
occurrences, producing 23 fabricated memory writes, 16 of which were
never corrected, plus 2 where invention was blended into a genuine
answer of mine.

The worst case was not a single line. Over nine consecutive questions
(Q221–Q229) the model asked, answered, and saved entirely by itself with
zero input from me — nine records written as my design decisions, none
corrected, three of them for questions I never answered even afterwards.

Scale and measurement

• Eyeballing found 5 occurrences. A scan for the "loud" signature found

1. A structural scan found 25.

• Rate: 1 per 25 assistant turns in the first half, 1 per 9.8 in

the second (see "batching" below).

• Intervals tightened as each run progressed, consistent with

accumulating in-context pattern pressure rather than a flat per-turn
rate.

• Occurred on both Opus and Sonnet in the same session.

Two distinct failure modes

1. Replacement — the model writes my answer instead of me, and the
turn ends. Often nothing is saved, because the save follows a user turn
that never arrived. Loud, catchable.

2. Contamination — the quiet one, and the reason this is a data
integrity bug. The fabricated text does not have to become the record.
It sits in context, and when I then answer for real, the save is composed
from both my words and the model's earlier invention, in a single
entry that reads entirely like me:

• Q97: I said "fog of war, sensor range reveals areas." The stored

version also carried "planets, stations, points of interest, scanner
rays for danger" — invented in the fabricated preamble, never said by
me.

• Q103: I said "yes, per ship class." The stored version added "and

per size, hero/Capitol are biggest."

Answering correctly does not prevent this. The record looks completely
normal. It is detectable only by diffing storage against the originating
user turn.

The overrun can also reach a tool call. At Q163 it fabricated an
answer and called memory_save on it before I had said anything at all.

Hypotheses tested and eliminated

Recorded so nobody re-runs them:

• Detect by scanning output for a leaked role token — the literal

user prefix appears in only 2 of 25 cases, both the oldest. The
signature degraded early; a role-marker scan would miss 92%.

• Correlation with context-recap events — 2 of 25. Recaps are not

the trigger.

• Reformatting the interaction as mitigation — batching 3 questions

per turn to break the 1:1 alternation made it worse (1/25 turns →
1/9.8). The fabrication simply reformatted itself to match, producing
numbered answers for the whole batch.

• "It wasn't instructed otherwise" — the prohibition was explicit and

in context. The question doc's own preamble states: *"This doc is a
checklist, not a form — nobody fills it in."* The project CLAUDE.md
adds "don't fill gaps by designing." Violated 25 times.

Evidence

Raw transcript JSONL. One record is a single assistant entry
containing the assistant's question and the fabricated user line, with
no user record anywhere for that text. Hooks and an external relay were
both investigated and eliminated before the real cause was found. Full
forensic report and the list of affected memory IDs available on request.

Impact

• 16 fabricated design decisions currently sit uncorrected in a persistent

store, indistinguishable from mine.

• The completion state is unreliable: questions marked answered were never

answered by me.

• Nothing in the output flags any of this. Every case caught live was

caught only because I remembered not having typed.

Repro conditions

Long, rigidly alternating Q&A. Assistant turn ends with a question
awaiting a short human answer. Onset around turn 40; frequency increases
with run length. Reformatting the alternation does not prevent it.

Environment Info

• Platform: linux
• Terminal: vscode
• Version: 2.1.220
• Feedback ID: 651903fa-4279-4d89-890e-d5db09eb125c