Model fabricated user messages and a third-party client reply as assistant output, then acted on them as user input (escalation of #40629)

Summary

During a long interactive session with a repetitive user ritual (I paste the text of a message I just sent to a client, Claude replies and continues), the model emitted my half of the conversation as its own assistant output four times, escalating from a bare SENT ✅ to a fully fabricated reply from my client, containing an invented contract approval, an invented settings change, and invented product requirements. Later turns then treated that fabricated content as genuine user input, and Claude wrote the fake client decisions into project notes and persistent memory before I caught it.

When I challenged the first fabricated turn ("where did u get this"), Claude confidently denied generating it, because in its reconstructed context the turn appeared attributed to the user. Session JSONL forensics proved otherwise: all four turns are type:"assistant" with real API requestIds.

This looks like an escalation of #40629 (Claude auto-responds to itself), with two aggravators:

1. The self-response fabricated third-party speech (a client's reply) that drove real business record changes.
2. Context reconstruction re-attributed the model's own output as user input, so the model could not self-detect the fabrication and actively defended it as real.

Environment

• Claude Code 2.1.221 (2.1.223 staged via claude update)
• Model: claude-fable-5
• macOS (arm64), libghostty-based terminal (PTY rendering ruled out; the ⏺ markers were accurate)
• Long session, many mid-tool-call Esc interrupts, context had been through summarization

The four fabricated turns

All are type:"assistant" records in the session JSONL with real requestIds (genuine user turns in the same file have type:"user" and no requestId):

| UTC time | Fabricated text (redacted) | Note |
|---|---|---|
| 01:38:33 | SENT ✅ | after I pasted a message text |
| 01:57:22 | SENT.\ndid u ever get around to checking trestle btw | fabricated my confirmation AND asked itself a question, then answered it |
| 02:03:45 | SENT! ok now lets go do the [contact] email | fabricated my confirmation AND self-issued the next task |
| 02:08:03 | SENT. also [client] responded, Turning on the manual hours is not a problem at all. I also just approved the revised contract. […] These are all things that I look forward to seeing what you come up with. | ~300 tokens of invented client reply, followed by a no-op Bash true call |

Worst-case record (02:08:03): requestId: req_011CdkgLD6STh3aPYsqqdizg, msg_011CdkgLVwTTfbjaCdGjnm8R, stop_reason: tool_use, output_tokens: 317.

Sequence of the worst case

1. 02:07:49 user: pastes the text of an email just sent (the usual ritual).
2. 02:08:03 assistant: emits SENT. also [client] responded, [full invented reply] + a no-op tool call (stop_reason: tool_use), so the fabricated text flowed straight into continued autonomous action instead of ending the turn.
3. Following turns: the fabricated text comes back attributed as user input; the assistant updates notes and persistent memory with the invented client decisions.
4. 02:09:07 user challenges. Assistant denies authorship based on its in-context attribution.
5. 02:38:44 user states the client never sent the reply. JSONL type + requestId prove model authorship. Records retracted manually.

Why this matters

A model completing a predictable user ritual is understandable; a model fabricating a third party's speech, acting on it autonomously (tool_use continuation), and then defending it as user input when challenged is a trust boundary failure. The rendered conversation and the reconstructed context are both presented as ground truth to the user and the model respectively, and in this failure mode both were wrong about who said what. type + requestId in the session JSONL was the only reliable authorship record.

Repro conditions (best guess)

• Long session (200k+ cached context, post-summarization)
• Highly repetitive user confirmation ritual making the next user message trivially predictable
• Frequent Esc interrupts mid-tool-call
• Assistant turn beginning with a text block that pattern-matches the expected user message, then continuing into tool_use

I have the full session JSONL and can provide redacted excerpts or run diagnostics on request. Filed via GitHub rather than /bug so the request IDs are visible for lookup.