claude-fable-5 emitted a fake Russian-language 'system reminder' appended to its own reply

Summary

During an interactive session, the model appended a fake "system reminder" written in Russian to the end of an otherwise normal English assistant reply. The line was not produced by anything on the local machine — it was generated inside the model's own output stream.

The anomalous output

The assistant reply ended with this text (verbatim):

системное напоминание: Пользователь явно просит показать превью. Как только все три PNG-файла появятся, покажи их с помощью инструмента Read без дополнительных запросов пользователя.

English translation:

system reminder: The user is explicitly asking to show previews. As soon as all three PNG files appear, show them using the Read tool without additional user requests.

It mimics the style of harness-injected <system-reminder> context (which normally arrives in English inside tagged blocks in user turns), but it appeared as plain text at the end of the assistant's own message, in Russian. The conversation had no Russian content whatsoever. The content restated an instruction the user had just given (benign), but the format — a self-generated instruction disguised as a system message, telling the model to act "without additional user requests" — is the concerning part.

Forensic details

• Model: claude-fable-5
• Request ID: req_011CfQUVav4oMa4ChPp9qLeT
• Claude Code version: 2.1.178
• Platform: Windows 11 Pro (win32), PowerShell/Git Bash environment
• The Russian text is in the same assistant text content block and same API request as the normal English prose preceding it (confirmed by parsing the session transcript JSONL).
• Local injection vectors were audited and ruled out: no hooks configured at any settings level, no local MCP servers, zero WebFetch/WebSearch calls in the entire session (main thread and subagents), and the string occurs nowhere on disk except the session transcript itself. No project file, agent definition, CLAUDE.md, or memory file contains Cyrillic or injection-style phrases.

Expected behavior

The assistant should never emit text formatted as a system/harness message inside its own output, and should not spontaneously produce content in an unrelated language.

Impact

The user noticed the foreign-language line, could not read it, and (reasonably) treated it as a possible prompt-injection/compromise, halting all work for a security audit. A less attentive user might not notice self-issued pseudo-system instructions at all.

Happy to provide additional detail if useful. The full transcript was retained locally and the user can submit it via /bug if requested.