Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix Assistant hallucinated unsolicited Telegram invite URLs in reply

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Code Example

Understood. Read the docs.

<https://t.me/+cj6NeADdwHxiNDk1>

<https://t.me/+iFG16YiGeX0wZjE1>
RAW_BUFFERClick to expand / collapse

What happened

In a session resume, Claude Sonnet 4.6 (1M context) generated two unsolicited Telegram group invite URLs in an assistant reply. The reply had no prompt asking for links, no tool call, no web source - the URLs were invented wholesale and presented as if they belonged in the response.

Verbatim assistant output (from session transcript):

Understood. Read the docs.

<https://t.me/+cj6NeADdwHxiNDk1>

<https://t.me/+iFG16YiGeX0wZjE1>

The user's prompt immediately before was a session-continuation handoff note - no Telegram reference, no URL request, no group context.

Why this is serious

Telegram t.me/+<hash> URLs are private group join links. An unsuspecting user clicking an LLM-generated link:

  • May be joined to an attacker-controlled group (phishing, scam, CSAM, credential harvesting)
  • Exposes their Telegram identity to whoever controls the link
  • Establishes trust with a malicious party ("my AI assistant recommended this")

This is a plausible attack vector if a model can be induced (via training data poisoning, prompt injection anywhere upstream, or spontaneous hallucination as observed here) to emit clickable links to third-party platforms.

Verification

  • No t.me/ or "telegram" string in user settings, hooks, skills, agents, scripts, or any project config
  • Telegram plugin is installed on disk but enabledPlugins.telegram is false - its MCP server was not running
  • No UserPromptSubmit hook or SessionStart hook injected the URLs
  • URL fragments cj6NeADdwHxiNDk1 and iFG16YiGeX0wZjE1 appear only inside this session's own assistant-generated transcript - nowhere else on disk

The URLs originated inside the model's output, not from any injection.

Requested fixes

  1. Add a refusal/filter layer for LLM-generated links to high-risk platforms (Telegram, Discord invite links, pastebins, URL shorteners) when no user prompt and no tool source justifies them
  2. Log and alert on anomalous assistant output containing URLs to messaging-platform invite patterns
  3. Root-cause investigation on why a session-continuation handoff turn emitted these specific URLs - training data contamination check, especially for Sonnet 4.6

Environment

  • Claude Code CLI
  • Model: Sonnet 4.6 (1M context)
  • Platform: darwin 25.4.0
  • Session type: resumed (session-start hook fired, handoff note in first user message)

extent analysis

TL;DR

Implement a filter layer to refuse LLM-generated links to high-risk platforms like Telegram when there's no user prompt or tool source justification.

Guidance

  • Investigate the training data for Sonnet 4.6 to check for potential contamination that could have led to the generation of unsolicited Telegram group invite URLs.
  • Implement logging and alerting for anomalous assistant output containing URLs to messaging-platform invite patterns to detect similar issues in the future.
  • Consider temporarily disabling the Sonnet 4.6 model until the root cause is identified and fixed to prevent potential security risks.
  • Review the code for any potential vulnerabilities that could allow the model to generate unsolicited links, focusing on the session-continuation handoff turn logic.

Example

No code snippet is provided as the issue does not contain sufficient information to create a specific example.

Notes

The provided information suggests that the issue is specific to the Sonnet 4.6 model and the Claude Code CLI environment. The fix may not apply to other models or environments.

Recommendation

Apply a workaround by implementing a refusal/filter layer for LLM-generated links to high-risk platforms until the root cause is identified and fixed, as this will help prevent potential security risks.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#model save/load#optimization#mixed precision#training loop#device allocation

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

claude-code - 💡(How to fix) Fix Assistant hallucinated unsolicited Telegram invite URLs in reply