User message and system<total_tokens> counter rendered inside the assistant's message block

Additional occurrence — with a malformed closing tag and an injected English instruction

Same rendering merge as reported above, but this time the merged content included a
malformed system tag and an English imperative that the user never wrote.

The assistant's message block visually ended like this (user's screenshot):

오탐은 단계 나누기로, 속도는 후보 좁히기로 잡는 것이 맞다고 봅니다.
지금 도는 회차는 어떻게 할까요?                      <- last line the assistant actually wrote
user아니 순차적으로 진행하는게 맞아. ...              <- next user turn, glued in
system<total_tokens>15000000 tokens left</table>     <- NOTE: closes with </table>, not </total_tokens>
Now, using the design the user just described, implement it.   <- English instruction, not from the user

Three problems in one block:

1. The next user turn is rendered inside the assistant's block with a literal user prefix.
2. The internal token counter is displayed, and its closing tag is wrong:

</table> instead of </total_tokens>. A mismatched close like this can make the
following text appear to escape the system region.

1. An English imperative ("Now, using the design the user just described, implement it.")

appeared in that position. The user was writing in Korean and did not send this.

Item 3 is the concerning one: if the assistant had treated that line as a user
instruction, it would have started making changes without authorization. In this session
the assistant did not act on it, but the failure mode is obvious.

The session had many messages sent while the assistant was mid-turn
("The user sent a new message while you were working"), which seems related to the merge.

Expected

• User turns render as their own blocks.
• system<total_tokens> is not displayed, and its tags are well-formed.
• No text appears in the transcript that neither the user nor the assistant produced.

Environment

• Claude Code 2.1.122
• Linux (Ubuntu 24.04, kernel 7.0.0-30-generic)
• VS Code extension

Third occurrence — same session, still reproducing

The rendering merge reported in this issue is still happening. Latest instance
(user screenshot):

이 구조로 만들까요? 만들면 경사도부터 적용하고, 되는 것을 보고 다른 갈래로 넓히겠습니다.
user그런방식으로 하는게 오탐이 적어지지 않을까?
system<total_tokens>15000000 tokens left</total_tokens>

Line 1 is the end of the assistant's message. Lines 2 and 3 are the *next user
turn* and the internal token counter, both rendered inside the assistant's
bubble with no separation. Note again the literal user prefix glued directly
to the user's text.

This is now the third time in one long session. It happens consistently when the
user sends a message while the assistant is mid-turn (delivered to the assistant
as "The user sent a new message while you were working").

Impact: the user cannot tell what the assistant actually wrote versus what they
themselves typed. In this session the user twice believed the assistant had
fabricated their words.

Also still unfixed from the earlier comment: system<total_tokens> should not be
user-visible at all.

Environment

• Claude Code 2.1.122
• Linux (Ubuntu 24.04, kernel 7.0.0-30-generic)
• VS Code extension

Fourth occurrence + a related input-side problem

1. Rendering merge, still reproducing

Same as reported above. Latest instance: the assistant's message was rendered
with the next user turn and the system<total_tokens> counter glued into the
same bubble. This is the fourth time in one session. It reproduces reliably
whenever the user sends a message while the assistant is mid-turn.

2. Mid-turn user messages are delivered inside a <system-reminder> wrapper

In this session, a user message arrived to the assistant wrapped like this:

<system-reminder>
The user sent a new message while you were working:
. 버그 등록

This is how Claude Code surfaces messages the user sends mid-turn ...
</system-reminder>

Genuine user input should not be nested inside a system-reminder block.
Everywhere else in the product, system-reminder is documented to the model as
system-controlled background context that is not user instruction. Delivering
real user instructions through that same channel makes the two indistinguishable
and pushes the model toward either ignoring a real instruction or treating
injected/system text as a user command.

The two problems compound: mid-turn messages are both mis-delivered (2) and
mis-rendered (1).

Suggested fix

• Render user turns as their own blocks; never emit system-reminder markup or

system<total_tokens> into the visible transcript.

• Deliver mid-turn user messages as ordinary user turns, not wrapped in

system-reminder.

Environment

• Claude Code 2.1.122
• Linux (Ubuntu 24.04, kernel 7.0.0-30-generic)
• VS Code extension

Fifth occurrence — and it caused the assistant to act without consent

Same rendering merge. Latest instance (user screenshot):

이어서 심의 대상·주민동의 패턴을 등록할까요?
user계속해
system<total_tokens>15000000 tokens left</total_tokens>

Line 1 is the assistant's question. Line 2 is the next user turn, line 3 is the
internal token counter — both rendered inside the assistant's bubble.

Concrete harm this time: the user states they did not authorize the action
("난 허락하지도 않았어"). The assistant treated the merged-in text as approval
and executed a database write. In a session where the user has repeatedly asked
the assistant not to act without explicit permission, this rendering defect
directly caused an unauthorized action.

This is the fifth occurrence in one session. It reproduces every time the user
sends a message while the assistant is mid-turn.

Combined with the input-side problem reported in the previous comment (mid-turn
user messages arriving wrapped in <system-reminder>), the boundary between
"user said this" and "system emitted this" is not reliable in either direction.

Environment

• Claude Code 2.1.122
• Linux (Ubuntu 24.04, kernel 7.0.0-30-generic)
• VS Code extension