Foreign third-party web-page content streamed into an in-flight assistant message (same requestId, +81s after reply ended)

Summary

Mid-conversation, ~15KB of third-party web page UI text (the HTML/UI copy of a Claude conversation-viewer tool called "ClawdeBoard", credited to "@jonasneves") was appended to an in-flight assistant message. The foreign content arrived on the same API request as the legitimate assistant reply, ~81 seconds after the reply's actual final sentence, and kept streaming until the user pressed interrupt (the injected text ends mid-word).

The injected content was not generated by the model in any way related to the conversation (an unrelated Hebrew work conversation), and does not exist anywhere on the local machine except the session transcript.

Key evidence (from the session .jsonl transcript)

• Request ID of the corrupted response: req_011CeKVYgm1ScaqpaebRTTjY
• Model: claude-fable-5 (1m context setting)
• Transcript line 157: type: assistant, timestamp 2026-08-23T10:06:22.530Z, requestId above, streaming usage record (output_tokens: 3)
• Transcript line 158: same requestId, timestamp 2026-08-23T10:07:43.902Z (~81s later), single text block of 15,032 chars = the legitimate ~120-char Hebrew closing sentence followed immediately by the ClawdeBoard viewer UI dump (easter-egg text, settings panel copy, ASCII cat art, etc.), truncated mid-word
• Transcript line 159: [Request interrupted by user] at 2026-08-23T10:07:43.906Z

Local causes ruled out

• No ANTHROPIC_BASE_URL / proxy env vars; scutil --proxy shows no system proxy
• No traffic-interception tools running (mitmproxy/Charles/Proxyman/etc.)
• Only one configured hook (a benign UserPromptSubmit language hint); no other hook events
• grep -r "ClawdeBoard" across ~/.claude and the workspace: the string exists only in this session's transcript

Environment

• Claude Code 2.1.237, VSCode extension (anthropic.claude-code-2.1.237-darwin-arm64), native binary
• macOS 26.6.1 (arm64)
• Date of incident: 2026-08-23 ~10:06–10:08 UTC

Impact / concern

Content from outside the conversation was presented to the user as assistant output. Beyond the confusion, this is a potential prompt-injection vector: if foreign text can enter the transcript as an assistant turn, subsequent turns treat it as conversation history.

Happy to provide additional transcript details privately if needed.