Assistant generated a fake "user" turn within its own response and then executed it as a user instruction on the next turn

[suraugi]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

Summary

At the end of an assistant response, the model did not stop and continued generating
user-style text beginning with "user…" (a role-boundary breakdown / runaway generation).
On the following turn, it mistook this self-generated text for a real user instruction
and incorrectly changed a spec (the start month of the fiscal year).

Details

• At the end of an assistant response, without stopping, the model generated user-style
  text: "userすばらしい　ただ、年度は１月始まりです…" ("user: great, but the fiscal year
  starts in January…").
• On the next turn, it mistook this text for a genuine user instruction and modified the
  implementation (the fiscal-year start month) based on a requirement the user never stated.

Impact

• The implementation was altered based on a requirement the user never stated.
• Real-world damage was avoided thanks to the user's immediate correction.

Reproduction clues

• In the session transcript, line 4554 (role: assistant), the end of content.text
  contains the injected string "userすばらしい　ただ、年度は１月始まりです…".
• The string does not appear on any role: user entry.
• Session ID: e4e3a9b3-a88a-4c1e-a487-a151eb40b723

Expected behavior

• The model must not keep generating text across the role boundary (user/assistant).
• Self-generated text in the conversation history must never be interpreted as a user instruction.

Request

• Strengthen the stop conditions at role boundaries.
• Strengthen guards so that self-generated text in the conversation history is not
  interpreted as a user instruction.

Environment

• OS: Windows 11 Home (10.0.26200)
• Shell: PowerShell
• Claude Code entrypoint: claude-desktop (Claude Code running inside the Claude Desktop app)
• Claude Agent SDK version: 0.3.165
• claude --version: N/A (standalone CLI not installed; running via the Claude Desktop app)
• Date observed: 2026-06-08

What Should Happen?

Summary

At the end of an assistant response, the model did not stop and continued generating
user-style text beginning with "user…" (a role-boundary breakdown / runaway generation).
On the following turn, it mistook this self-generated text for a real user instruction
and incorrectly changed a spec (the start month of the fiscal year).

Details

• At the end of an assistant response, without stopping, the model generated user-style
  text: "userすばらしい　ただ、年度は１月始まりです…" ("user: great, but the fiscal year
  starts in January…").
• On the next turn, it mistook this text for a genuine user instruction and modified the
  implementation (the fiscal-year start month) based on a requirement the user never stated.

Impact

• The implementation was altered based on a requirement the user never stated.
• Real-world damage was avoided thanks to the user's immediate correction.

Reproduction clues

• In the session transcript, line 4554 (role: assistant), the end of content.text
  contains the injected string "userすばらしい　ただ、年度は１月始まりです…".
• The string does not appear on any role: user entry.
• Session ID: e4e3a9b3-a88a-4c1e-a487-a151eb40b723

Expected behavior

• The model must not keep generating text across the role boundary (user/assistant).
• Self-generated text in the conversation history must never be interpreted as a user instruction.

Request

• Strengthen the stop conditions at role boundaries.
• Strengthen guards so that self-generated text in the conversation history is not
  interpreted as a user instruction.

Environment

• OS: Windows 11 Home (10.0.26200)
• Shell: PowerShell
• Claude Code entrypoint: claude-desktop (Claude Code running inside the Claude Desktop app)
• Claude Agent SDK version: 0.3.165
• claude --version: N/A (standalone CLI not installed; running via the Claude Desktop app)
• Date observed: 2026-06-08

Error Messages/Logs

Steps to Reproduce

Summary

At the end of an assistant response, the model did not stop and continued generating
user-style text beginning with "user…" (a role-boundary breakdown / runaway generation).
On the following turn, it mistook this self-generated text for a real user instruction
and incorrectly changed a spec (the start month of the fiscal year).

Details

• At the end of an assistant response, without stopping, the model generated user-style
  text: "userすばらしい　ただ、年度は１月始まりです…" ("user: great, but the fiscal year
  starts in January…").
• On the next turn, it mistook this text for a genuine user instruction and modified the
  implementation (the fiscal-year start month) based on a requirement the user never stated.

Impact

• The implementation was altered based on a requirement the user never stated.
• Real-world damage was avoided thanks to the user's immediate correction.

Reproduction clues

• In the session transcript, line 4554 (role: assistant), the end of content.text
  contains the injected string "userすばらしい　ただ、年度は１月始まりです…".
• The string does not appear on any role: user entry.
• Session ID: e4e3a9b3-a88a-4c1e-a487-a151eb40b723

Expected behavior

• The model must not keep generating text across the role boundary (user/assistant).
• Self-generated text in the conversation history must never be interpreted as a user instruction.

Request

• Strengthen the stop conditions at role boundaries.
• Strengthen guards so that self-generated text in the conversation history is not
  interpreted as a user instruction.

Environment

• OS: Windows 11 Home (10.0.26200)
• Shell: PowerShell
• Claude Code entrypoint: claude-desktop (Claude Code running inside the Claude Desktop app)
• Claude Agent SDK version: 0.3.165
• claude --version: N/A (standalone CLI not installed; running via the Claude Desktop app)
• Date observed: 2026-06-08

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

N/A (standalone CLI not installed; running via the Claude Desktop app)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

No response

[github-actions]

Found 3 possible duplicate issues:

1. Model hallucinates Human: prefix in assistant response and self-executes fabricated user commands (Agent Teams) #43572
2. Claude Opus 4.6 hallucinates user message, then responds to itself #27805
3. [MODEL] Opus 4.6 hallucinated a detailed user response after AskUserQuestion, then acted on it #46322

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[github-actions]

This issue has been automatically closed as a duplicate of #43572.

If this is incorrect, please re-open this issue or create a new one.

🤖 Generated with Claude Code