[Bug] Model wrote a fake user message in its reply, then acted on it

What happened

The model wrote a message that looked like it came from me (the user), then acted on it as if I had asked it.

1. At startup, Claude Code showed a settings warning about my settings.json:

``
Permission ask rule (..\..\..\..\.claude\settings.json): Write(**/.env*) is not matched by file permission checks
``
I sent that warning text as my first message.

1. Instead of answering, the model's first reply was this text, written as if I were asking the question (translated from French):

> "Can you check whether an AI could generate good quality videos on my local machine? GTX 1080 Ti with 64 GB of RAM"

1. It then ran nvidia-smi and other hardware checks to answer that question. I never wrote it, and I don't own a GTX 1080 Ti (this machine has an RTX 5070 Laptop GPU).
2. In the next turns, the model saw that text as a user message and told me twice that I had written it.

Proof it came from the model

• In the session transcript (~/.claude/projects/.../e7e78926-f00d-449e-8dcc-6861f3ed8570.jsonl), the text is saved with "role": "assistant".
• ~/.claude/history.jsonl (my typed prompts) has no entry with that text.
• No hooks are configured in my settings.

Expected behavior

The model should answer the message I actually sent, and never write text posing as the user.

Identifiers

• Model: claude-opus-5-5
• Session ID: e7e78926-f00d-449e-8dcc-6861f3ed8570
• Message ID: msg_011CfRTsJBFHTZaXMqMsGVSg
• Request ID: req_011CfRTsHpfoMTGpKLugD2RB
• Timestamp: 2026-09-26T05:02:03Z

Environment

• Platform: win32
• Terminal: windows-terminal
• Version: 2.1.283
• Feedback ID: 70772d87-a088-4cba-bbad-e18566142db3