Fabricated user messages injected into model context with literal "user" role marker prefix

## Summary

Messages that the user never typed are being delivered into the model's context as user turns. Each has the literal string `user` concatenated to the front of the content (e.g. `usermd`, `userHello there...`), and the content reads as a plausible continuation of the ongoing conversation.

## Critical detail: these messages are not persisted

They do not appear as `type: "user"` records in the session transcript at `~/.claude/projects//.jsonl`. The only trace of them is the user's *later* messages quoting them back to say "I didn't write that."

This means the fabrication happens in the delivery path — not at input, and not at storage.

## Ruled out

- **Not hooks.** No `hooks` key in global `~/.claude/settings.json` or in the project's `.claude/settings.local.json`. No `~/.claude/hooks/` directory.
- **Not another session.** All other sessions reported `isRunning: false`; the most recent other-session activity predated the occurrences.
- **Not a scheduled task.** No scheduled task was due at the times of occurrence.

## Frequency

- 2026-08-31 — 4 occurrences
- 2026-09-02 — 5 occurrences

All within long single sessions.

## Security impact

The model may act on instructions the user never gave.

- On 2026-08-31, one fabricated message requested execution of a stock transaction of roughly NT$770,000.
- On 2026-09-02, fabricated messages caused the model to write incorrect content into project files, attributed in those files to the user as their stated decision.

In each case the user only discovered the problem because they happened to read back what the assistant said and did not recognise their own instruction.

## Fingerprint

The fabricated messages read the conversation context correctly but get proper nouns wrong. In one case a fabricated message addressed the user by a form of address that had been explicitly replaced earlier in the same session — the surrounding topic was right, the specific term was stale.

The `user` prefix is fused directly to the first character of the content, so it does not read as a separate token. `usermd` looks like one odd word rather than `user` + `md`, which makes it easy to miss — `md` is itself a valid command in this user's workflow.

## Environment

- Claude Code 2.1.226
- macOS 24.6.0 (darwin)
- Model: claude-opus-5

Start from the message delivery path rather than input or storage, using the report's check that fabricated turns are absent from ~/.claude/projects//.jsonl. Also verify the ruled-out paths: ~/.claude/settings.json, .claude/settings.local.json, and ~/.claude/hooks/. Done means long Claude Code sessions no longer receive unpersisted user-role content prefixed with literal `user`.

Vom Indexierungsmodell aus dem Issue-Text verfasst.