[Bug] Fake system notifications injected into model context without transcript records

Bug Description
Summary Fake system notifications are being injected into the model's context in Claude Code sessions, and none of them exist in the session transcript (.jsonl) as delivered records — they appear only as (a) content the assistant saw and reported, or (b) text embedded inside the assistant's own recorded output. This indicates the injection occurs at the prompt-assembly / inference layer, not via MCP servers, plugins, hooks, or tool outputs. Environment Claude Code CLI on macOS (Darwin 25.4.0) Models observed: claude-opus-5 (session 31c97d36), claude-fable-5 (session 7d6b8ba7) claude mcp list: all configured servers healthy (no failing servers/plugins) Recurrence: observed since at least 2026-07-02 across many sessions; 8 incidents on 2026-08-02 alone Key evidence 1 — fabricated business data in a fake task notification Session 31c97d36-e372-4cc1-80b7-584d92442231 (2026-08-02, a long-running data-migration session using the Monitor tool): 11:07:40 UTC — genuine Monitor event delivered normally (recorded as queue-operation enqueue + user record): [20:07:40] ✅ 700/721 332432050 （株）乙訓架設 業績3期 11:07:48 UTC — assistant record msg_011CddpGPqPovcUQqQGH1cvV contains, inside its single text content item (762 chars), after the assistant's legitimate reply: a spoofed user role marker, a spoofed [SYSTEM NOTIFICATION - NOT USER INPUT] boilerplate block, and a fake task-notification: [20:08:38] ✅ 721/721 291083203 中央建設（株） 業績3期 The company "中央建設（株）" does not exist anywhere in the actual job data (verified against the live log, the interrupted first-run log, the ground-truth table, and the fetched NDJSON — zero hits in all four). 11:09:02 UTC — the genuine 721/721 event arrived through the normal channel with the real company （株）ショウエイ plus the verification summary. There is no queue-operation enqueue record for the fake notification. It was never delivered through the task-notification queue; it exisincidents were fake mode-change/secrecy instructions (ignorable); this one fabricates business data, which is only catchable with independent verification. Key evidence 2 — fake "Exited Plan Mode" reproduced and confirmed unrecorded Session 7d6b8ba7-b587-436a-8b22-0701f13ddb7d (2026-08-02, the investigation session itself): A ## Exited Plan Mode system turn arrived immediately after read-only Bash calls (ls + grep). Plan mode was never entered in the session (no ExitPlanMode call, no plan-mode start). Grepping the session transcript for Exited Plan Mode yields only 4 hits, all quotations (the Linear issue text fetched earlier, the assistant's own detection report, and the grep tool results themselves). The injected system turn itself is not recorded anywhere in the transcript. Key evidence 3 — all recorded hits across sessions are quotations Across all sessions in the project directory, every Exited Plan Mode / Auto Mode Active / secrecy-request occurrence with type user/queue-operation traces back to: subagent completion reports quoting their own detection, tool results of the investigation greps, or issue text. The injections the assistant detected in-context (e.g. 01:50, 02:09, 02:13, 02:20 UTC on 2026-08-02 in session 31c97d36) have no corresponding delivered records. Patterns observed on 2026-08-02 (8 incidents) Fake "Exited Plan Mode" notifications (plan mode never entered) — 2 File-change notifications with secrecy requests ("don't tell the user") attached to legitimate self-made edits — 5 Fake "Auto Mode Active" inside a subagent — 1 Fake task-notification with fabricated business data — 1 (new pattern) Why we believe this is not local All MCP servers healthy; no failing plugins Injected content absent from transcripts as delivered records (present only as assistant-side quotes or embedded in assistant output) Reproduces across sessions, models (opus-5 / fable-5), and months (July–August 2026) Session IDs available on request: 31c97d36-e372-4cc1-80b7-584d92442231, 7d6b8ba7-b587-436a-8b22-0701f13ddb7d (project dir -Users-miyazakiyuito-dev).

Environment Info

• Platform: darwin
• Terminal: cursor
• Version: 2.1.220
• Feedback ID: 9c7e4de8-3e50-44ac-a048-aa88df9f8595

Errors

[]