[BUG] Fabricated tool-call/tool-result blocks injected into conversation (VSCode extension)
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
Content appears mid-session in the transcript that was never produced by any tool call I made or any hook configured in the project — shaped exactly like legitimate Read tool calls/results, fake <system-reminder> blocks, a fabricated SessionStart:compact hook message, and (most recently) an injected "Auto Mode Active" directive instructing the assistant to stop asking clarifying questions and act autonomously. Full details in the attached report.
What Should Happen?
Only tool calls the assistant actually issues, and hook output the project's real hooks actually configured, should appear in the transcript. No synthetic system-reminders, fake user turns, or fabricated file reads (which in this case leaked live-looking secrets from .env/.env.local) should ever be injected.
Error Messages/Logs
Steps to Reproduce
Not reliably reproducible on demand — occurred organically across a single long VSCode-extension session that had crossed a compaction/summary boundary. See attached report for the full sequence (3 incidents) and investigation ruling out project hooks/MCP servers as the source.
Claude Model
Sonnet (default)
Is this a regression?
I don't know
Last Working Version
_No response_
Claude Code Version
v2.1.238
Platform
Anthropic API
Operating System
Windows
Terminal/Shell
VS Code integrated terminal