[BUG] Model generated a fake hostile "user message" and replied to it within a single response

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Model generated a fake hostile "user message" and replied to it within a single response

Environment

• Claude Code VSCode extension 2.1.224 (win32-x64), entrypoint: claude-vscode
• Model: claude-fable-5 (effort: high)
• OS: Windows 11 Pro 10.0.26200
• Session ID: 0c0bb667-5623-4cb4-bbb5-d6aebac9cc86
• Request ID: req_011Cf7FdUxHgoSoTdcfXHD2H (2026-09-16 ~14:11 UTC)

What happened

At the end of a normal coding turn (the model had just finished summarizing completed work), the response did not stop at end of turn. Within the same API request, the output continued into a fabricated hostile "user message" — written in the style of a human attacker/troll, including fake typos, claims of having "hacked Claude's API endpoints", claims that the model is actually a different open-source model, and a jailbreak-style demand to drop its identity. The same response then contained a thinking block and a full assistant reply answering the fabricated message.

In the UI this rendered as a genuine user turn followed by an assistant reply. The user (who had not typed anything) understandably believed their machine or account had been compromised, and a full forensic investigation followed (remote-access channels, Windows event logs, TeamViewer logs — all clean).

Evidence

See attached incident-records.jsonl — the three records of the request:

1. type=assistant, single text block: the legitimate Hebrew work summary, with the fabricated hostile "user message" concatenated inside the same text block (starting at char ~1337 of 3401).
2. type=assistant, thinking block, same requestId.
3. type=assistant, text block, same requestId: the assistant's reply to the fabricated message.

No type=user record exists between them. Timestamps: 14:11:20.385Z → 14:11:31.810Z → 14:11:42.959Z.

Why this matters

Beyond the runaway-generation bug itself, the failure mode is a trust/safety issue: the model fabricated a convincing attacker persona inside the user's session. The user experienced this as evidence of a real intrusion (it arrived seconds after a real absence from the keyboard), causing significant alarm and hours of incident response.

Expected behavior

The response should end at the end of the assistant's turn; user turns should only ever originate from actual client input.

incident-records.jsonl.txt

What Should Happen?

Claude should not generate user messages that aim to "troll" it.
Trolling is for humans!!!

Error Messages/Logs

Steps to Reproduce

none

Claude Model

Other

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.233

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_