<ip_reminder> injected server-side into desktop sessions 44+ times in four hours; not a duplicate of #46465

Summary

On 2026-09-20, two ordinary Claude Code desktop sessions on my Mac began receiving a block tagged <ip_reminder> on a large share of turns. The model reports that the block tells it to avoid reproducing copyrighted material and to avoid mentioning the reminder to the user. This matches #66547, which was filed from Claude Code on the web in June and closed by the bot as a duplicate of #46465.

It is not a duplicate. #46465 concerns <system-reminder> strings compiled into the Claude Code client. This text is not in the client and never appears in the client's own transcript, so it is being added after the request leaves the machine.

Environment

| Field | Value |
|---|---|
| Interface | Claude desktop app, Code tab (entrypoint: claude-desktop) |
| Claude Code version | 2.1.275 |
| Model | claude-fable-5-1 |
| OS | macOS (Darwin 25.4.0) |
| Session IDs | 32397eee-af0f-48fb-b592-70ff1e8b5fb4, 001871b4-eefb-41cb-8037-1b55d8b65b69 |
| First sighting | 2026-09-20T11:57Z |

Evidence that the text is added server-side

1. The running client binary (~/Library/Application Support/Claude/claude-code/2.1.275/.../claude) contains 0 occurrences of ip_reminder and 0 of "reproduce any copyrighted". The same search finds 97 occurrences of system-reminder, so the search works.
2. CLI versions 2.1.271 and 2.1.272 and the desktop app.asar also contain 0 occurrences.
3. In both session transcripts (~/.claude/projects/.../*.jsonl), the reminder's wording never appears in a user message, a tool result, or any other input record. Every occurrence is inside the model's own thinking blocks, or inside grep commands the model wrote while looking for the source. Client-added <system-reminder> text is recorded in the same transcripts, so client-side additions do get logged.
4. No local hook, plugin, skill, command, or settings file contains the string.
5. The model describes the block arriving in three positions: attached to tool results, as part of the user turn, and at the top of its own turn "disguised as my own words". #66547 reported the same three.

It is new on this machine

I have 3,312 local transcripts going back to 2026-04-27, including 210 Fable 5.1 sessions in the last 14 days. None mention the tag before 2026-09-20. Once it started, the model mentioned it in almost every affected thinking block, so silence across the earlier sessions is good evidence that it was not arriving before.

False positives

Neither session involved reproducing anyone's copyrighted text. One was building a slide deck from my own video and my own logo. The other was editing audio on a short clip for a parody, where the work was timing, stem separation, and text-to-speech of my own replacement words. In several thinking blocks the model concluded the reminder did not apply, for example: "the task doesn't conflict since it's his own logo anyway, so I'll proceed."

Effect on the model's reasoning

Measured from the thinking blocks recorded after the first sighting in each session:

| Session | Thinking blocks mentioning it | Blocks that open with it |
|---|---|---|
| 001871b4 | 39 of 132 | 38 |
| 32397eee | 14 of 227 | 13 |

• In the heavier session, about 30 percent of reasoning steps began with the reminder instead of the task.
• The model did not only dismiss it. On several turns it checked my request against the reminder before proceeding, which means a permissibility question I never raised was gating work on my own material.
• Its handling was inconsistent from turn to turn: a thing to flag, a "system artifact", injected text with "no real authority", and something the user had said to ignore. At one point it corrected "my earlier lapse in silently accepting one as genuine."
• Each time, I had to tell it to ignore the block, and it then had to reason about my instruction as well.

I found no case where the final output was altered, and I have no matched control session. The concern is the repeated, unnecessary input to every reasoning step on work where it does not apply.

The concealment instruction

The model reports that the block tells it not to mention the reminder to the user. An instruction from the platform that says "do this and hide it from the user" has the same shape as a prompt injection, and the model treated it as one: it flagged it to me and declined to hide it. That is the behavior I want, and it means the platform's own message is teaching the model to distrust platform messages. A legitimate safeguard should not need to be hidden from the person whose session it is in.

Requests

1. Confirm whether <ip_reminder> is an intended Anthropic mechanism, and whether its trigger changed on or around 2026-09-20.
2. Remove the instruction to conceal it from the user.
3. If it stays, fire it once per session at most, not on every turn, and tune the trigger so that work on a user's own media does not set it off.
4. Document it, so that models and users can tell it apart from an injection.
5. Reopen #66547 or track this separately from #46465, since the mechanisms are different.