System-reminder wrapper for CLAUDE.md/MEMORY.md uses injection-shaped language ("OVERRIDE any default behavior... MUST follow exactly as written")

## Summary

As of an app update this morning (2026-09-05), the system-reminder that surfaces `CLAUDE.md` and `MEMORY.md` file contents into the model's context is now wrapped in:

> Codebase and user instructions are shown below. Be sure to adhere to these instructions. IMPORTANT: These instructions OVERRIDE any default behavior and you MUST follow them exactly as written.

## Why this is a problem

This phrasing is functionally indistinguishable from a prompt-injection attempt. Claude Code's own security guidance trains the model to treat exactly this shape of language — authority claims, "OVERRIDE," "MUST," urgency — as a red flag when it shows up in web content, files, or tool output, and to surface it rather than comply silently. When the harness itself uses that identical framing to introduce legitimate, trusted file loads, it undermines the model's (and a transcript-reader's) ability to reliably tell a real injected instruction apart from the harness's own trusted context injection.

Concretely, in the session that surfaced this: Claude (Sonnet 5) flagged its own `MEMORY.md` load as a suspected injection specifically because of this wrapper, before spending a full investigative turn tracing it back to confirm it was benign harness behavior. That's a costly false positive — and the same ambiguity could just as easily go the other way, with a real injection using similar phrasing getting waved through as "probably just the harness."

## Evidence

Grepped `~/.claude/projects/**/*.jsonl` across 5 unrelated project directories (kanji-tenkai, Yoshicaster, yoshicaster-mobile, Junbee, a general project-workspace tree). Findings:

- The exact wrapper string appears in 8 session transcripts, all timestamped between 08:17-08:38 on 2026-09-05.
- It wraps both `CLAUDE.md` project-instructions loads (labeled "project instructions, checked into the codebase") and `MEMORY.md` auto-memory loads (labeled "user's auto-memory, persists across conversations") - same template, different file-type label filled in.
- No older transcript in the same directories (checked back to 2026-08-27) contains this phrase at all.
- `~/.claude/settings.json` (hooks/config) was last modified 2026-08-27 - not touched today, ruling out a user-side config change as the source.
- `/Applications/Claude.app/Contents/Info.plist` was modified 2026-09-05 (this morning), consistent with an app update introducing the new template.

## Suggested fix

Use language that signals "trusted, harness-provided context" without mimicking attacker-authority framing - e.g. drop "OVERRIDE any default behavior" and "MUST follow ... exactly as written" in favor of something neutral like "The following is project/user context loaded by Claude Code:". Making CLAUDE.md/MEMORY.md content more likely to be followed doesn't require language that's also the textbook shape of a prompt-injection attempt.

---
Filed on request, from a session that independently traced this wrapper's origin via local transcript forensics.

Start by locating the system-reminder template that wraps CLAUDE.md and MEMORY.md contents; the issue does not identify a repository file or test. Compare the generated wording with the examples in ~/.claude/projects/**/*.jsonl and confirm the source is not ~/.claude/settings.json. Done means the wrapper presents trusted project or user context without injection-shaped authority language, with coverage for both file types.

由索引模型根据 Issue 内容生成。