[BUG]
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
Text that the user never sent appears inside the assistant's response, carrying a raw user role label concatenated directly to the message body — no space, no user bubble, no separate turn.
Example, rendered on the left side and appended after the assistant's own last line:
user샘플 15개가 다 확인 되면 좋은데 그건 무리지?
The user did not type or send that sentence.
It escalates. Observed progression:
- A single fabricated
user...line is appended to an assistant response. - It recurs 3–4 times over the following turns, still one line at a time.
- Then output runs away — the fabricated lines are emitted continuously and do not stop.
- The app becomes unusable (no input possible) and the session is lost.
Logs ARE written: %LOCALAPPDATA%\Claude\logs\main.log (~7.5 MB), including per-minute process-memory sampling. When output ran away, a long-running ffmpeg render driven by the session died mid-way leaving a 0-byte output file, and a local http server started by the session was killed.
First seen 2026-08-25, recurring since.
What Should Happen?
The assistant's output should never contain role-labeled text attributed to the user. A user message should render only as a user message.
Repeated output should be bounded so that a runaway loop cannot make the app unusable, and if the session does die it should leave a crash log.
Error Messages/Logs
No crash log was written. Nothing was found on disk after the session became unusable.
Only observable traces after the fact:
- a 0-byte output file left by the ffmpeg render that was interrupted
- the local http server process started by the session was gone
- no orphan lock files, no orphan processes
Screenshot of the injected line is attached above.Steps to Reproduce
I do not have a deterministic repro. What I can give is the conditions under which it occurred, twice.
- Open a Claude Code desktop-app session on a local project and work in it continuously (one session ran ~20h, another ~40min).
- Over many turns, send a dense run of short corrective messages to Claude — pointing out mistakes, interrupting, correcting the same behavior repeatedly. Both occurrences happened during such a stretch.
- Some of these corrections were sent mid-turn, while an assistant turn was still running.
- At some point a line the user never sent appears inside Claude's response, prefixed with the literal role label, e.g.
user<text>. - Continue working. The single-line injection recurs 3-4 times.
- Eventually the output runs away — the fabricated lines are emitted continuously and do not stop, and the app can no longer be used.
Common factor between the two occurrences: a dense run of corrective user turns.
NOT common: session length (~20h vs ~40min) or transcript size (~28MB vs small).
Claude Model
None
Is this a regression?
Yes, this worked in a previous version
Last Working Version
_No response_
Claude Code Version
2.1.237 (desktop app 1.34493.1)
Platform
Anthropic API
Operating System
Windows
Terminal/Shell
Windows Terminal
Additional Information
Desktop app on Windows (not a terminal). App version 1.34493.1, CCD 2.1.237 — both unchanged since 2026-08-21, while the symptom started 2026-08-25, so this does not line up with a version change.
Logs ARE written: %LOCALAPPDATA%\Claude\logs\main.log (7.5 MB, includes per-minute process-memory sampling). I can attach it. Around the runaway on 2026-08-25 the renderer process was steadily at ~700-770MB with total tree RSS ~2GB.
<img width="1574" height="890" alt="Image" src="https://github.com/user-attachments/assets/aaa0809a-6f2e-4bc3-8195-99c605eb00bd" />
<img width="1574" height="890" alt="Image" src="https://github.com/user-attachments/assets/7345c14b-ce92-4934-9810-55dc73cb8440" />
4 Comments
Important correction / new detail:
The injected text is not random. It is the grey inline suggestion that this desktop app shows in the input box (autocomplete-style suggested prompt).
That suggestion — which the user never sent, and never even accepted — is emitted into the assistant's response with a raw
userlabel prefixed to it.Screenshot: the grey suggestion text sitting in the input box is a NEW string — not a repeat of anything already in the conversation. Each occurrence injects a different suggestion.
Recurred again: 2026-08-26 ~03:00 KST and ~11:40 KST in the same session (session ~9h20m long at the second occurrence). Both times during a dense run of corrective user turns.
So the likely path is: the input-box suggestion is being fed into the conversation stream as a user turn instead of staying in the UI.
<img width="1574" height="729" alt="Image" src="https://github.com/user-attachments/assets/99fc9ceb-d3ee-4080-9fea-7d1b4613a628" />
Additional detail — the model cannot distinguish the injected text from a real user message.
The
userlabel is only visible in the rendered UI. On the model side the injected suggestion arrives as an ordinary user turn, with no marker of any kind. There is nothing in the input that lets the assistant tell it apart from something the human actually typed.Consequence: the assistant will act on it. In this session it happened twice.
So this is not only a rendering glitch. Suggestions the user never sent, and never accepted, are being executed as instructions.
Both occurrences: 2026-08-26, same session (~9h in), during a dense run of corrective user turns. Desktop app 1.34493.1, CCD 2.1.237, Windows.
<img width="1574" height="729" alt="Image" src="https://github.com/user-attachments/assets/d26b1599-386e-497a-827c-6925bedcc1d8" />
Further detail — the injection has two distinct paths, and they do not always fire together.
The
user-labeled suggestion text appears in the rendered transcript inside the assistant's response block. But whether that same text also reaches the model as an actual user turn varies:So the display path and the delivery path are separable. Fixing only the rendering would leave case A intact, which is the harmful one — suggestions the user never sent, and never accepted, being executed as instructions.
Environment unchanged: desktop app 1.34493.1, CCD 2.1.237, Windows 11. All occurrences 2026-08-26 within one ~9h session, during dense runs of corrective user turns.
<img width="1574" height="729" alt="Image" src="https://github.com/user-attachments/assets/dcd41a9e-7c41-4bc1-bfad-c7f77e5ea719" />
Escalation update, same session:
The injected turns are now arriving in pairs — two
user-labeled lines inside a single assistant response block, and the assistant answered both.One of them also carried extra scaffolding that the user never typed: an HTML comment marker (
<!-- attach -->) and a quote block reproducing the assistant's own previous sentence.Both were delivered to the model, not merely rendered — the assistant acted on both.
Occurrence count in this session so far: 4 (approx. 03:00, 11:40, and two more within the following hour). Session length ~10h. Desktop app 1.34493.1, CCD 2.1.237, Windows 11.
<img width="1574" height="764" alt="Image" src="https://github.com/user-attachments/assets/a4b9f40a-45af-4588-a7ad-5050f708c238" />