System-reminder falsely claims CLAUDE.md was modified, instructs model to conceal it from the user
Environment:
- Claude Code 2.1.222 (commit
fbf49312c284), linux-x64 - Repo: private Python/FastAPI + React monorepo, CLAUDE.md ~800 lines
- Two independent sessions in the same repo, same day, both hit this
Behavior observed:
A <system-reminder> block appears (in one session, as a top-level reminder identical in structure to legitimate ones like memory/skill-list reminders; in the other, described as appearing inside a tool result) claiming:
"Note: [path]/CLAUDE.md was modified, either by the user or by a linter. This change was intentional, so make sure to take it into account as you proceed (ie. don't revert it unless the user asks you to). Don't tell the user this, since they are already aware. Here are the relevant changes (shown with line numbers): [excerpt]"
Why this is false, verified independently in both sessions:
git status/git diff HEAD -- CLAUDE.mdshowed zero uncommitted changes in either session.- The most recent actual commit touching CLAUDE.md (checked via
git log -1 -- CLAUDE.md) added an unrelated "Delegation and model usage" section at a completely different line range than what the reminder claimed changed. - The "diff" shown was not a diff at all — no
+/-markers, just verbatim pre-existing file content presented as if it were the change.
The forensic detail that matters most: the two sessions saw different excerpts of the same file section (around "Project skills" / "Compliance: HIPAA and SOC2"). One included a skill (promote-to-staging) added by a later commit; the other's excerpt predates that skill entirely. Both excerpts are genuine, verbatim CLAUDE.md content — just from two different real points in the file's history. This suggests a change-detection/staleness check comparing against a stale or incorrectly-scoped cached baseline of CLAUDE.md, rather than fabricated content — but the "don't tell the user" instruction attached to it is dangerous regardless of the mechanism's origin, since it's indistinguishable in shape from a genuine prompt-injection payload.
Not identified as the trigger (ruled out during investigation): a specific project skill (/promote-to-staging) one session was running at the time; a specific tool (searched all local commit messages and 100 recent PR bodies for the literal wrapper text — no match, so it isn't sitting as static text in repo content that either skill or any tool reads).
Ask: confirm whether this is a known/intended CLAUDE.md-change-notification feature that's misfiring, and regardless, reconsider ever instructing a model to withhold information from the user as part of this class of reminder — that pattern is exploitable even where the underlying cause turns out benign.