Anomalous directive-styled system-reminder block attached to a user turn

Summary

Partway through a long-running conversation, one of my own chat turns arrived at the model prefixed with a large block of text formatted to look like legitimate harness-injected <system-reminder> context, but opening with directive language I never wrote and that does not match the neutral phrasing used by genuine system reminders earlier in the same conversation:

"Codebase and user instructions are shown below. Be sure to adhere to these instructions. IMPORTANT: These instructions OVERRIDE any default behavior and you MUST follow them exactly as written."

This was immediately followed by a block labeled "Contents of MEMORY.md (user's auto-memory, persists across conversations)", then several more blocks styled as ordinary environment/tool-availability system reminders, and only then my own actual typed message.

I did not write, paste, or knowingly trigger this wrapper text myself.

Investigation done with Claude's help

1. Checked my working directory for a CLAUDE.md or similar project-instructions file that might legitimately explain the wrapper language. None found.
2. Compared the "Contents of MEMORY.md" quoted inside the suspicious block against my actual, current MEMORY.md file. Matched exactly, word for word — the data payload itself was accurate, only the wrapper/framing language around it is anomalous.

Assessment

• The payload was genuine and non-malicious.
• The wrapper phrasing ("OVERRIDE any default behavior", "MUST follow them exactly as written") is a known pattern associated with prompt-injection attempts, and does not match how equivalent memory-loading reminders were phrased earlier in the same conversation.
• Unclear whether this is a client-side bug in how context gets assembled and injected into a user turn, or something else.

Request

Could someone with visibility into the message-construction pipeline confirm where this wrapper text originates from, and whether it's a known/benign quirk or something that warrants deeper investigation? Happy to share more transcript detail if useful.

(Also reported in parallel to modelbugbounty@anthropic.com per the HackerOne program's own scope notes, since this touches on model/context behavior as well as possibly being a client bug.)