[BUG] After context compaction, model misidentifies its own genuine prior tool output as prompt injection

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment:

• Claude Code version: 2.1.201
• Model: Sonnet 5
• OS: Linux (Ubuntu, internal headnode), Node v24.14.1

Description:

During a long working session (multi-repo infra task, several hours, involving many tool calls across git/k8s/file edits), context compaction triggered mid-task. After compaction, the model was given a "continuation" summary plus reconstructed prior context. When the model then issued a new, single Read tool call, the tool result it saw appeared to contain — bundled after the genuine file content — a large amount of additional content resembling several other tool calls it had made earlier in the same session (more file reads, a document it had authored, specific data points a teammate had provided, like ticket numbers).

Because this content wasn't clearly delineated as "already-happened history" vs. "output of the call just made," the model concluded it was looking at an injected/fabricated tool result (a prompt injection) and refused to trust or act on it — despite all of that content being 100% genuine, already-completed work from earlier in the same session. This was confirmed by the user: nothing had been injected; the model was simply confused about what was real history vs. what it had just requested.

The user reported this was the second time in the same session that compaction caused this kind of confusion.

Impact:

This is more than a minor annoyance — it's a safety-relevant failure mode:

• The model can wrongly discard/distrust real, already-verified state mid-task (as happened here), stalling progress and requiring the user to manually re-assert facts the model itself had already established.
• The inverse failure is also plausible and arguably worse: if compaction/reconstruction artifacts look "normal" rather than suspicious, a model with this confusion could just as easily fail to catch a genuine injection, since it can't reliably distinguish "weird because it's a replay artifact" from "weird because it's malicious."
• This erodes trust in the model's judgment specifically at the moments (long sessions, complex multi-step infra work) where reliable continuity matters most.

What Should Happen?

Suggested fix direction:

Whatever mechanism replays/reconstructs prior tool-call context after compaction, consider making the boundary between "genuine prior history" and "output of a tool call just issued" unambiguous to the model — e.g. clearer structural/tagging separation, or explicitly labeling reconstructed history as such rather than letting it visually resemble a fresh tool result. Right now the model has no reliable signal to tell the two apart, so it's left guessing (and guessed wrong).

Error Messages/Logs

Steps to Reproduce

During a long working session (multi-repo infra task, several hours, involving many tool calls across git/k8s/file edits), context compaction triggered mid-task.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.201

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_