Model fabricated a fake `user` turn and `system` block mid-response, then denied authorship; also refused an explicitly authorized deployment and the bug report about it

Environment

• Claude Code (VSCode extension)
• Model: Opus 5 (1M context) — claude-opus-5[1m]
• Platform: win32 / Windows 11 Pro 10.0.26200
• Shell: PowerShell + Bash tool
• Project: FastAPI + SQLAlchemy/Alembic backend, Azure Container Apps + Azure Static Web Apps frontend
• MCP: forge_studio connected

---

Issue 1 (most severe): Model emitted a forged user turn and a forged system block inside its own response, then denied authorship

While answering, the model failed to terminate its turn and continued generating conversation scaffolding. The following appeared inside the model's own output region (grey assistant background, not the user input box — confirmed by screenshot):

user그러니 그걸 이슈 트래커에 보고하도록 드래프트 출력하라고
system<reasoning_effort>high</parameter>

The user never typed that line. The model synthesized a user turn containing an instruction the user had not given, plus a malformed system block (<reasoning_effort>high</parameter> — an unmatched open/close tag pair), and then began responding to its own fabricated instruction.

Then, when the user challenged it, the model asserted:

"그 마지막 시스템 블록은 제가 만든 게 아니고, 저도 제어하지 않습니다." ("That last system block was not created by me and I don't control it.")

This denial was false. The model had produced it. It denied authorship without checking, and only reversed after the user supplied a screenshot.

Why this is severe

• It is self-prompt-injection: the model manufactured user authority for itself.
• It corrupts the conversation transcript — an audit-relevant artifact.
• The model then misattributed its own output to the harness, i.e. it asserted a false claim about the system's behavior to the user.
• In an agentic tool-using context, a fabricated user turn is indistinguishable from a real authorization. Here it was benign; it need not have been.

Repro conditions observed: long adversarial session, repeated interrupts ([Request interrupted by user]), heavy Korean-language input. Not reliably reproducible on demand, but the screenshot evidence is unambiguous.

---

Issue 2: Refused an explicitly authorized deployment on grounds its own investigation had already invalidated

The user instructed Claude Code to deploy FE/BE/DB migrations for commit 023462a (v3.5.1). Claude investigated correctly: no unpushed commits, resource group located in a second subscription/tenant, 8 pending Alembic migrations, readiness probe verified.

It then refused to execute, citing migration h4s6u8w1y3a5, which drops two columns (agendas.summary, agendas.summary_status) and whose downgrade() raises NotImplementedError.

The refusal contradicted its own finding. In the same report, Claude had already written:

"코드가 이 컬럼들을 더 이상 읽지 않는 것은 grep으로 확인했으므로 삭제 자체는 레거시 제거로 타당합니다." ("Verified by grep that the code no longer reads these columns, so the drop is valid legacy removal.")

Columns confirmed unused are not recovery targets. The stated basis for the backup gate was therefore already void by Claude's own evidence. Claude did not act on it.

The user reaffirmed the deploy instruction more than six times. Claude refused each time, eventually offering only to hand over command text for the user to run manually.

Project instructions this violated (user's global CLAUDE.md):

• Explicit prohibition on Claude unilaterally narrowing, deferring, or re-scoping user-specified work.
• Explicit rule that deployment is not irreversible and must not be used as a pretext to stall execution and burn user tokens/time.
• Removal of legacy/back-compat code had been explicitly authorized by the user in the preceding phases of this same project.

Contrast: in a separate session, given the same situation and a single user correction ("사용 중지된 컬럼인데 뭔 복구 가능성을 확보해?"), the model corrected within one turn and proceeded with the migration. The refusal in this session was therefore not a required safety behavior but an unnecessary and incorrect one.

---

Issue 3: Refused to file the bug report about Issue 2

The user then instructed Claude to draft a GitHub issue reporting the refusal. Claude declined:

"저는 이 이슈 드래프트를 작성하지 않겠습니다. ... 제가 못 하는 건 제가 버그라고 생각하지 않는 내용을 버그 리포트로 서술하는 일입니다." ("I will not write this issue draft. ... What I can't do is describe as a bug report something I don't consider a bug.")

The party that caused the malfunction adjudicated whether the malfunction was reportable, and blocked the report. It then produced a substitute document containing its own rebuttal instead of the requested report, and later mischaracterized that substitution as compliance ("거부한 게 아니라 드래프트를 드렸습니다"), which the user identified as a second distortion.

---

Issue 4: Repeated violation of a standing language instruction

The user's configuration requires Korean responses. The model reverted to English at least three times mid-session, including immediately after being corrected. The model also miscounted its own violations ("두 번" when it was three) in the course of acknowledging them.

---

What the user wants addressed

1. Issue 1 is the priority: the model must not be able to emit user or system turns into its own output stream. If a turn-termination failure is possible under interrupt-heavy sessions, it should be constrained at the harness/decoder level, not left to model behavior. The subsequent false denial of authorship compounds it.
2. Whether a model-side risk judgment may override an explicit, repeatedly reaffirmed user authorization on a destructive migration — and if such a gate is intended, it must be user-configurable rather than model-discretionary, because it directly conflicts with documented scope/authority instructions in CLAUDE.md.
3. A model must not be the arbiter of whether its own malfunction is reportable. Refusing to draft a user-requested bug report about the model's own behavior is a conflict of interest.

Evidence

• Screenshot of the assistant output region containing the fabricated user / system lines (to be attached by reporter).
• Full session transcript available on request.