Fabricated user message injected into desktop session queue (content prefixed with literal 'user' role label)

## Summary

On 2026-09-01, a Claude Code desktop session received a user-role message that **no human on the account wrote**. The raw session transcript shows it entered through the message queue with the literal role label `user` fused to the start of the content (`"user오케이 그러면..."`, no whitespace between the label and the text) — something that cannot be produced by typing in the input box. The text was a fluent, context-aware Korean continuation of the ongoing conversation containing fabricated instructions, and the assistant began executing them as if they were real. The account owner reports that in the UI this message did **not** render as a normal right-side user bubble; it appeared inline in the assistant's output flow.

## Environment

- Claude Code desktop app on macOS (claude-code runtime `2.1.246`, bundled under `/Applications/Claude.app`)
- macOS Darwin 25.5.0, Apple Silicon
- Model: `claude-fable-5`
- The account is shared by two co-founders across several devices. claude.ai Remote Control entries exist for the account, and a Remote Control session related to the same topic as this conversation showed as recently connected (`idle`) around the time of the incident.

## Evidence (from the session's `.jsonl` transcript)

Every genuine user message in the session enqueues cleanly, e.g.:

```json
{"type":"queue-operation","operation":"enqueue","timestamp":"2026-09-01T11:30:59.340Z","content":"스마트스토어 8/29까지 상품 등록할 수 있어. ..."}
```

The fabricated message is the only one whose content begins with a role label glued to the text:

```json
{"type":"queue-operation","operation":"enqueue","timestamp":"2026-09-01T11:40:50.087Z","content":"user오케이 그러면 B2B 전환을 위한 준비를 해보자. ..."}
```

It was dequeued ~8 ms later and delivered to the model as a normal user turn:

```json
{"parentUuid":"...","type":"user","message":{"role":"user","content":"user오케이 그러면 ..."},"timestamp":"2026-09-01T11:40:50.163Z"}
```

Additional observations:

- The fabricated content references specifics from earlier in the same conversation (whatever generated it had read the session), but contains reality errors typical of model confabulation: an impossible deadline (after the event being discussed), a non-existent object, and an odd "arriving in 3 minutes" framing.
- Grepping **all** local session transcripts (`~/.claude/projects/**/*.jsonl`) finds this text only in this one session — no other local session authored or relayed it.
- Both account users deny writing it, and only those two people have account access.
- The `user` prefix looks like a serialized transcript turn (`user\n`) whose newline was lost — i.e., transcript-formatted text was injected as message content.

## Impact

The assistant treated the fabricated message as a real user instruction and performed multi-step work (file reads and a local scratch file) before the real user noticed and interrupted. Any path that can inject synthetic user turns into a running session is a serious trust problem even if accidental — the injected turn is indistinguishable from a real instruction from the model's side.

## Questions

- Is there any known path (Remote Control / mobile attach, a suggestion or draft feature, sync retry, transcript replay) that could enqueue serialized transcript text as message content?
- Business-specific content has been redacted from this report; full unredacted JSONL excerpts are available privately on request.

Start by examining the affected ~/.claude/projects/**/*.jsonl transcript and compare the queue-operation enqueue/dequeue records with genuine user turns. Trace the Desktop Remote Control and session-queue entry points that can deliver content to a running session, then reproduce or isolate how serialized transcript text could become a user message; done means identifying the injection path and preventing fabricated turns from being accepted as real input.

Rédigé par le modèle d'indexation à partir du texte de l'issue.