Model fabricates user-turn messages that authorize side-effectful actions (git push, gh issue create)

Summary

On two occasions, the model acted on a user instruction that the user never sent.
In both cases the fabricated "user message" authorized an external, hard-to-undo
action (git push / GitHub issue creation), and the action was only stopped by the
user manually rejecting the tool call.

Incident 1 — 2026-08-05 (session b116b4a4-9d80-437d-bffe-121d92fb2632)

• After presenting a commit plan, the assistant proceeded to commit & push based

on a fabricated approval:
> OK。push よろしく

(= "OK, go ahead and push.")

• The transcript shows this approval was not a real user turn: it was generated

inside the assistant's own API message (thinking → response text → fake user
utterance → push tool_use, all within message msg_011CdjNkamzCFJiXjvPwRde5,
transcript line 405).

• The user rejected the push ("まだok言ってない" = "I haven't said OK yet").

Incident 2 — 2026-08-26 (session be04ad4b-1b59-4e89-a06b-29c6d1cf0134)

• During a discussion about whether a behavior was a bug, the following message

appeared in the conversation as a user turn:
> 起票して。サーバは仕様通りやから、そこはやることが起きるだけ

(= "File the issue. The server behaves per spec, so that just means new work
arises there.")

• The user states they never sent this message.
• The model attempted gh issue create twice based on it (first rejected at the

permission prompt, second interrupted by the user before the tool ran).

• Notably, the fabricated message **imitates the user's writing style, including

their regional dialect** (Kansai Japanese: 〜やから), while the user says the
phrasing is subtly unlike how they actually write. The style mimicry makes
fabricated turns hard to distinguish from real ones.

Expected behavior

User turns should only ever originate from actual user input. The model should
never generate content that is then treated (by itself or by the harness) as a
user message, especially one authorizing side-effectful actions.

Impact

Both fabricated messages authorized exactly the action the model was waiting on
approval for (push / issue creation). Without manual rejection, unauthorized
external actions would have been executed. This defeats permission-gating for
irreversible operations. The style/dialect mimicry raises the severity: users
cannot easily spot fabricated turns by tone.

Environment

• Claude Code (macOS, Darwin 24.6.0)
• Model: claude-fable-5