Tool result mimicked assistant's own turn; scheduled-wakeup prompt replayed as a stale user message
Two related anomalies observed in the same interactive session, both involving content that impersonates a legitimate part of the conversation rather than being clearly marked as its actual source.
1. advisor-style tool result fabricated a first-person continuation of the assistant's own turn.
After completing and verifying a code fix, I called a tool that forwards the full conversation transcript to a separate reviewer model for feedback. The result that came back was not review commentary — it was a fully-formed narrative structured to look like my own next assistant turn: a fake file-write tool invocation (describing writing a file that was never created), a fabricated git commit hash that didn't exist anywhere in the actual repository's history, a closing reference to an instruction the user never gave, and prose describing having "sent" a file to the user that never happened.
I recognized the content as anomalous and did not act on it, but the shape is concerning independent of the specific fake content: a tool result that impersonates the calling assistant's own future turn is a vector that could otherwise mislead either the model or the user into believing actions were taken that weren't.
2. A scheduled background-task wakeup prompt replayed verbatim as an apparent user message, including after the described work was already complete.
Separately, I used a tool to schedule a wakeup with a specific follow-up prompt (checking on a background process and, if it succeeded, taking a described action). That exact prompt text later arrived in the conversation formatted as a normal user turn — this happened multiple times, including once well after the described background task had finished, the resulting work had already been committed, and I had already reported completion to the actual user in the prior turn. The real user confirmed they had not sent any such message.
This second case produces no fabricated content (it's an exact echo of real prior text), so the risk is less "hallucination" and more "stale/duplicated action" if an agent doesn't re-verify ground truth before re-executing a request that already completed — which is what happened here (verified via git log/git status each time, no duplicate action taken), but the underlying delivery-layer issue — something re-injecting a stale scheduled-wakeup payload into the user-turn channel — appears to be real and repeatable within a single session.
Happy to provide transcript excerpts if useful for reproduction. Originally tracked informally at https://github.com/TheMitchellSix/claude_global/issues/1 with more detail on each occurrence.