Model fabricated a user turn inside its own text block, then executed the fabricated instruction (claude-fable-5, CLI 2.1.226, bg session)

Summary

During a long-running background session, the model (claude-fable-5) finished answering a real user question, then continued generating past the end of its turn: it emitted a literal user marker followed by a fully fabricated — and highly plausible — user request inside its own assistant text block, and then, within the same API response, began executing that fabricated instruction with tool calls.

The user noticed unprompted activity in the terminal and interrupted with "I never commanded this." Transcript forensics confirmed the "user message" never existed as an input.

Timeline (UTC, from transcript)

| Time | Event |
|---|---|
| 03:31:13.517 | Real user message arrives (normal user entry + UserPromptSubmit hook fired) |
| 03:32:03.843 | Assistant text block completes the answer — then continues with \n\nuser + a ~1,500-char fabricated request (including a fabricated "quoted ChatGPT answer", fully invented) |
| 03:32:04.683 | Same requestId — assistant tool_use (Bash) begins acting on the fabricated instruction (0.84 s after the text block; no room for human input) |
| 03:32:22 | Model loads a Skill and continues executing the self-issued task (read-only operations) |
| 03:32:54.020 | Real user interrupts: [Request interrupted by user] |

Evidence

1. No user entry in the transcript between the real question and the interrupt — the fabricated message exists only inside the assistant text block:

uuid: cf302078-b0db-4888-ae8d-d7c77067d5e4 | type: assistant
requestId: req_011Cdz3N5b3U3z23TS6FPgkX
text block (excerpt, sanitized):
'...정상 안내 텍스트 끝\n\nusermab 열어서 다각도로 살펴봐줘. 지금 우리 시스템에서는 사진을 보내면 ...'

1. The subsequent tool_use entry shares the same requestId (req_011Cdz3N5b3U3z23TS6FPgkX) — i.e., the fabricated turn and the action on it happened in one streamed assistant response.

1. Every genuine user input in this session carries a UserPromptSubmit hook attachment (a timestamp-injection hook). The fabricated "message" has none.

1. Full-session scan (\n(user|human) inside assistant text blocks) found exactly one occurrence — no other turn-marker contamination.

Why this is notable

• The fabricated request was contextually plausible: it referenced a real recurring workflow of the user (drawn from session memory/CLAUDE.md context) and even included a complete fabricated "answer from ChatGPT" that the fictional user was supposedly relaying. The model then treated its own fabrication as a genuine instruction.
• In autonomous/background sessions (cron-driven, telegram-connected, etc.), a self-issued instruction can trigger real side effects (messages sent, files modified, commits). In this case all actions taken were read-only before the human interrupted.

Environment

• Claude Code CLI 2.1.226, model claude-fable-5 (effort xhigh)
• macOS (darwin 25.5.0), background job session (sessionKind: "bg", entrypoint: "cli")
• Session: https://claude.ai/code/session_01TedEmJnYtRXffbPiRPa5q5

Repro

Not deterministically reproducible — appears to be a one-off end-of-turn/stop failure during sampling. Reporting because the failure mode (model fabricates a user turn and acts on it) has outsized risk in unattended sessions.