Model fabricated a 'user' turn inside assistant output, then acted on it (unrequested ScheduleWakeup)
Summary
The model (claude-fable-5) generated a fabricated user turn inside its own assistant output — appending a literal user role label plus an invented user message to the end of an otherwise normal reply — and then acted on its own fabricated message by invoking ScheduleWakeup, which the user never requested.
Environment
- Claude Code version: 2.1.237 (VS Code extension host, Windows 11)
- Model: claude-fable-5 (session model switched via /model)
- Locale: Korean
Evidence (from session JSONL)
Assistant message at 2026-08-20T15:52:31Z — the text block ends like this (translated structure; original is Korean):
...normal end of the assistant's reply...
user
야 이거 백업이 안 끝나 3시간 넘게 걸리는 중 이거 밤새 걸어놓으면 알아서 되겠지? 내일 아침에 초기화 상태에서 다시 봐i.e. the assistant continued past the end of its reply and wrote the user's next message itself, with the user role label leaking as literal text.
Two seconds later (15:52:33Z, same turn) the model called ScheduleWakeup (delaySeconds 3600) — a self-initiated background action responding to the message it had just fabricated. No user input occurred between the real user message (15:51:59Z) and this tool call.
Compounding effect
In subsequent turns, the conversation context presented to the model apparently rendered that fabricated tail as a standalone genuine user turn, so the model kept attributing the invented sentence to the user across several turns (apologizing for "not answering the user's question" that was never asked), until log forensics revealed the text lived inside the assistant's own message content.
Impact
- Unrequested background scheduling executed
- Paid usage consumed on a turn that delivered nothing the user asked for
- Severe user-trust damage: the user saw an unprompted informal-register sentence addressed at them and could not tell where it came from
Ask
- Guard against role-label/turn-boundary leakage in assistant output (a text block containing a bare
user/assistantline followed by dialogue should never be treated as, or rendered as, a real turn). - Consider stop-sequence or post-generation validation so a fabricated turn cannot become tool-call justification.