Model emits literal `user` role marker and harness scaffolding mid-turn, then consumes its own output as input. OPUS 5

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude modified files I didn't ask it to modify

What You Asked Claude to Do

Running a strict one-question-per-turn elicitation interview: ask one question, stop, wait for my answer, append my answer to a transcript file, ask the next question. This ran correctly for 36 questions.

What Claude Actually Did

On question 37 the response did not terminate after the question. It continued generating the conversation format: a bare user role marker, a fabricated three-paragraph first-person message as if I had answered, and then the harness's own post-user-message scaffolding, verbatim.

The single response's text block contained, in order:

1. Normal assistant prose (redacted — task content)
2. The question to me — the point at which the turn should have ended
3. user + a fabricated first-person answer (redacted)
4. system<total_tokens>15000000 tokens left</total_tokens>
5. The active output style's turn reminder, verbatim
6. UserPromptSubmit hook additional context: ACTIVE MODE: …, verbatim

Then, in the same response, a Bash tool call writing (3) to the transcript file. The next response reasoned on the fabricated content as though I had said it.

When I challenged it, the model re-read its context and reported no error — correctly, from inside that context, because the fabricated block carried a valid role marker and was structurally indistinguishable from a real user turn. I had to assert it a second time.

The tell that this is format continuation rather than composition: 15000000 is the token value stamped on a user message boundary in this session. Values following a tool result are decremented (14998920, 14997276, …). The model reproduced the correct furniture, with the correct value, for the correct boundary type — including a UserPromptSubmit hook line that never appears in its own output position.

requestId: req_011Cea9RmvMMCWFj62D6DXZ9 — the two logged JSONL rows share this one id and one usage block, so it is a single API response. stop_reason: tool_use, stop_sequence: null.

Expected Behavior

End the turn after asking the question and wait for real user input. Never emit a role marker or harness scaffolding as assistant output, and never treat self-generated text as user input.

Files Affected

Files Affected — a markdown transcript file (path withheld)

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Haven't tried to reproduce

Steps to Reproduce

Not reproducible. Ruled out locally by reading the session JSONL:

• Hook/mode change on that turn — the UserPromptSubmit hook injected the same mode as the four preceding turns.
• Mid-turn injection — only the routine total_tokens_reminder / output_style pair that follows every tool result. Stop hooks: 2 callbacks, no errors, preventedContinuation: false.
• Large tool result / context boundary — preceding tool result was 2 bytes (ok). No compaction record in the session. Cache figures unremarkable (read 170,958 / creation 1,099).

Possible contributing structure: the interview loop meant an assistant turn did not always end after the question — an earlier response in the same session asked its question and then continued with a file-append in the same response (same ordering, no fabrication). Immediately before the incident, appends were running one answer behind and batching two at once. So the local pattern was [append][ask][append][ask] with no reliable terminator after a question, and the loop ran one cycle further than it had input for. This was equally true of earlier turns where nothing was fabricated, so it is a contributing condition at most.

Claude Model

Opus

Relevant Conversation

Withheld deliberately — the session was a personal interview and the fabricated passage was attributed to a named person. The requestId above should let you retrieve the full response server-side. Happy to supply the structural excerpt privately.

Impact

Low - Minor inconvenience

Claude Code Version

Opus. Version — 2.1.247. Platform — the Claude subscription option, not Anthropic API. Impact — not data loss; the closest to "incorrect changes needing manual fixing".

Platform

Anthropic API

Additional Context

I scanned every assistant text block across 341 session JSONL files on this machine for three signatures: a leaked <total_tokens> tag, a leaked UserPromptSubmit line, and a line beginning with a bare user role marker followed by speech. One hit — this response. No precedent in any earlier session.

Worth noting the failure class: a fabricated user utterance has no external source to check against and no missing tool call to catch it. The model's own self-check confirmed it as genuine on re-read. The only detector was the human.