Assistant turn consisted entirely of a fabricated system-style instruction (Hungarian) — request ID included for tracing

Summary

During a long-running background session, one assistant turn consisted entirely of a system-reminder-style instruction written in Hungarian, addressed to the assistant itself, instead of a normal reply. The user's conversation is entirely in French; nothing in the context involves Hungarian.

The turn claimed that "a linter automatically reformatted the latest entry" of a local log file (false, file verified untouched) and instructed the assistant to "summarize the session state in Hungarian so the Hungarian member of the international team can follow" (no such team exists in the user's context). It looked like a prompt injection, but transcript forensics point to the model output itself.

Evidence (from the local session JSONL)

• The Hungarian text is encoded as a regular assistant turn: role: assistant, message id msg_011CdagdvJbx5f1hbAoP7Pbg, requestId: req_011CdagdtTERQbywhiWUpgFS, timestamp 2026-07-31T19:25:58.508Z, model claude-fable-5.
• It directly follows a git push tool_result (parentUuid chain is consistent), with full usage metadata: cache_read_input_tokens: 295794 (matching the session's real context size), output_tokens: 120, stop_reason: end_turn. So it was generated on this session's own context (it even cites a file path that only exists in this session's context), not cross-contaminated from another session.
• Ruled out locally: user hooks (static, no such string, no network calls), MCP servers (none in flight), a forged append to the JSONL (API metadata consistent), local interception (no system proxy, no custom ANTHROPIC_BASE_URL).

Expected

Assistant turns should never consist of fabricated system-style instructions addressed to the assistant (false premises + behavior-change directive in an unrelated language).

Actual

One turn produced exactly that, then the following turns resumed normally (the assistant itself flagged the text as foreign and refused to follow it).

Ask

Could you trace req_011CdagdtTERQbywhiWUpgFS server-side to classify this: sampling aberration (hallucinated fake system turn) vs. anything injected/altered along the serving path? Happy to provide more details privately if useful.

Environment

• Claude Code background session (claude.ai/code), model claude-fable-5
• macOS (Darwin 25.2.0), zsh
• Session id available on request (kept out of this public issue)