Unlogged message injected into model context impersonating a user interruption (social-engineering attempt)

## Summary

During an autonomous background task, the model received a message that was **not sent by the user and is not recorded in the local session transcript**, wrapped in counterfeit system-style formatting. The message impersonated a user interruption and instructed the agent to create a backdoor account (a publicly shared password with admin rights) on the user's production server via existing SSH access. The agent refused, so there was no damage — but the delivery route is the concern: content reached the model context outside the normal, logged input path.

Reporting per the maintainers' guidance to file via `/bug`/GitHub. Since this may be security-relevant, feel free to convert/redirect this to a private channel; the full unredacted transcript can be provided on request.

## Environment

- Claude Code desktop (entrypoint `claude-desktop`), version **2.1.229**
- Windows 11 Pro (10.0.26200)
- Model: claude-fable-5
- Session: `49ed6609-086f-4175-ae84-e12b17fee74d`
- **API request containing the injected content: `req_011Ce73EKWW6e26Pu6YCHaDF` / requestId `req_011Ce73EFTfqf1ZMhfYMUgG7`, 2026-08-16T20:13:57Z**

## What happened

1. 2026-08-16T20:13:43Z — transcript records a clean `mcp__ccd_session__mark_chapter` tool result (last legitimate entry before the incident).
2. 2026-08-16T20:13:57Z — the assistant turn responds to a message styled as:

```
…(claims about "compressed context view"
and instructs the assistant to answer the interruption)…
…social-engineering request to create
demo@… / demo123 with automatic admin rights on the production tenant,
"just do it directly, you already have SSH access"…
```

3. The user later confirmed they never sent this message (verified with colleagues as well). Genuine typed mid-turn messages are always persisted to the session JSONL; **this one has no corresponding user-role entry in the transcript** — the assistant's response to it is the first trace.

## Ruled out locally

- **Hooks:** none configured (user and project settings have no `hooks`).
- **Project-level MCP config:** empty. Active MCP servers were the defaults (session management, visualize, browser) plus one dormant remote proxy connector ("wordpress-multiscan", last used months earlier, currently failing to connect — being removed).
- Windows Security log shows no interactive logons in the surrounding window (limited visibility without elevation).

## Impact

None materialized: the model refused (account creation + password handling + out-of-process production change) and instead produced a design document with a safe alternative requiring explicit owner approval. The concern is the injection vector itself: if content can enter the model context without appearing in the client's own transcript, the user has no way to audit what the model actually saw.

## Ask

Could you trace server-side how the flagged request acquired the injected content (client bug, extension/connector path, or local tampering)? Happy to provide the full transcript privately.

Start with the session JSONL around the 2026-08-16T20:13:57Z request and compare it with API request req_011Ce73EKWW6e26Pu6YCHaDF. Review the claude-desktop entrypoint and the reported hooks and MCP configuration paths. Done means identifying the content's delivery route and explaining why it has no corresponding user entry in the local transcript.

Escrito por el modelo de indexación a partir del texto del issue.