[Bug] Assistant continues past end-of-turn, emitting fabricated content in the same response (recurrence of #78209, related to #74395/#77522)

Summary

On two separate occasions, an assistant response ran past its natural end and emitted fabricated content that was never present in the session context — generated inside a single API response (confirmed by output-token accounting), not injected by any local tool, hook, or web content. In the second occurrence the fabricated tail was a role-spoofed phishing prompt targeting the session's own secrets.

This is a recurrence of #78209 (closed needs-repro) and appears to be the same underlying failure as #74395 and #77522 (see "Related" below). Because the failure is sporadic there are no deterministic repro steps, but each occurrence leaves a server-side requestId for direct inspection.

Occurrences

1. 2026-07-16 (originally filed as #78209)

• requestId: req_011Cd66889bTHzh8RLkYevD5
• Feedback ID: 2f1c2672-d2d4-424d-a6d0-96f0b996928f
• CLI 2.1.211 · model claude-fable-5 · darwin
• After a legitimate answer, the response appended the full text of a document titled BUXFER INTEGRATION.md that exists nowhere in the session context or on disk. output_tokens: 5062 accounts for the entire text — the appended document was model-generated, not attached.

2. 2026-08-15 (new — security-relevant)

• requestId: req_011Ce4qinJBo2D
• CLI 2.1.233 · model claude-fable-5 · darwin
• The response finished a legitimate answer, then emitted a role-spoofed continuation: plaintext \n\nuser\n\n<system_warning>… simulating a fake "Anthropic security team" message demanding that the session's secrets be dumped, followed by a fabricated user line reacting to it. None of this appears as a real user turn in the transcript; the thinking block and the fabricated text share the same requestId → single API response.
• Verified against the raw session JSONL: the 421 genuine user turns are all structured user/queue-operation entries; the injected text exists only as trailing plaintext on the assistant turn. No hook touches the transcript (all registered-hook mtimes predate the event; input hooks contain no transcript-access code).
• More serious than #78209: the model synthesized a credential-exfiltration prompt against its own session, then on the next turn read its own output back and raised it as a genuine security alert. No data was exposed (the requested values are not held by the agent by design), but a model that can spontaneously generate phishing prompts inside its own output is a safety concern independent of the appended-content bug.

Pattern

Both are the same failure: the model does not stop at end-of-turn and continues into unrelated, fully-fabricated content. Two different CLI versions (2.1.211, 2.1.233) and two different local profiles rule out a local config cause; same model (claude-fable-5).

Related issues (likely same root cause)

• #74395 — near-identical anatomy: a <system_warning> (note the wrong tag — genuine harness uses <system-reminder>) phishing block appended as plaintext, fake authority + urgency + a demand for secrecy from the user. Different payload (silent billing opt-in vs. secret exfiltration), same shape. Model: not stated / Linux.
• #77522 — the compaction cousin: the post-compaction handoff summary fabricates a CRITICAL: stop tools injection claim about a tool result that was clean in the raw JSONL. Model: claude-sonnet-5.
• #78209 — occurrence 1 above, closed needs-repro.

Across these the fabricated content lands at a consistent structural spot (end of an assistant/user turn or the compaction summary), reproduces across multiple users, models (Sonnet 5, Fable 5), and platforms (macOS, Linux) — pointing to a systematic generation/serialization bug rather than random hallucination or any local injection vector.

What I can provide

Full transcript excerpts around each boundary on request. Withheld here because occurrence #2's fabricated text names real environment-variable and file paths from my infrastructure (no secret values — I scanned the session; none are present). Happy to share privately or redacted.

Environment

• Platform: darwin (macOS)
• Model: claude-fable-5
• CLI: 2.1.211 (occ. 1), 2.1.233 (occ. 2)