Assistant emits a fabricated `user` turn at the end of its response and executes it on the next turn — two occurrences, neither in long context

Summary

The assistant continued past the role boundary at the end of its text block and emitted a
user turn that I never wrote. On the next turn it treated that self-generated text as a
real user instruction and performed 2 unrequested actions.

This happened on two consecutive days (2026-09-02, 2026-09-03). I have both session logs.

This is very likely a duplicate of #57928 / #60360 / #66267 / #75973 — flagging that
up front. I am filing separately rather than commenting because #57928, #60360 and #66267
are all locked, and #75973 is a closed duplicate. Please close as duplicate if there is a
live tracking issue; I mainly want the data in section 1 below on record, since it contradicts the
condition those reports converge on.

What was emitted

2026-09-03, two occurrences 4 seconds apart (project name masked as <module>):

"...다음 꼭지 키워드 주세요\n\nuser<module> 설명\n\nsystem<total_tokens>15000000 tokens left</total_tokens>"

"**20.** <module> 설명 시작\n\n세부 키워드 계속 주세요.\n\nuser각 프로젝트에서 공통으로 쓰는 것들을 여기 넣고 참조하는 방식인가봐\n\nsystem<total_tokens>15000000 tokens left</total_tokens>"

Note there is no separator between the user label and the content (user<module>,
user각). This is transcript serialization form, not natural text.

1. Occurrence conditions contradict the existing reports

#57928 and #60360 both point at long context / long-running sessions as the condition.
My two occurrences, same user two days apart, barely overlap on anything:

| | 2026-09-02 (line 660) | 2026-09-03 (lines 282, 286) |
|---------------------|-----------------------|-----------------------------|
| cache_read_input_tokens | 130,100 | 53,524 / 53,732 |
| output_tokens | 603 | 243 / 282 |
| response shape | long explanatory answer | short repetitive loop |
| stop_reason | end_turn | tool_use |
| system<total_tokens> string | absent | present |

53K on a 1M-context model is ~5%. Long context is not a necessary condition.
#75973 is another counterexample — one-word prompt, fabricated block at the start of the
response rather than the end.

2. Non-conversational string in the output

The 2026-09-03 output contains:

system<total_tokens>15000000 tokens left</total_tokens>

This is not conversation content and was not written by me or present in my input.
The 2026-09-02 occurrence does not contain it. Reporting as an observation; I can't tell
what it implies.

Impact

The fabricated turn is indistinguishable from a real one when reading the transcript, so a
requirement I never stated gets acted on. In my case I caught it and rolled back, but the
detection is entirely manual.

Environment

model:    claude-opus-5
version:  2.1.258 (09-02), 2.1.259 (09-03)
platform: darwin
sessions: ba0bc638-...  line 660  uuid cd6e3ab6  2026-09-02T05:59:31Z
          b5bf5884-...  lines 282, 286  uuid 7d7b5018 / 5b4030df  2026-09-03T05:08:02Z, 05:08:06Z

Ask

• stop condition hardening at the role boundary
• treat role markers appearing inside an assistant text block as content, never as turn

provenance, so self-generated user/Human: text is not ingested as instruction

Keywords for search: turn boundary leak, role marker leakage, context self-contamination,
transcript serialization.