claude-code - 💡(How to fix) Fix [Bug] Messages sent during command execution mixed with output causes false prompt injection detection [1 participants]

claude-code2026-04-17 01:01:27

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

anthropics/claude-code#49625•Fetched 2026-04-17 08:35:53

View on GitHub

Comments

Participants

Timeline

Reactions

Author

SeriousBug

Participants

SeriousBug

Timeline (top)

labeled ×5renamed ×1

Root Cause

{"parentUuid":"13de7680-e291-4aa4-8eb9-26806548291d","isSidechain":false,"message":{"model":"claude-opus-4-7","id":"msg_01DoJjg6pFShQNVQHTGKf9vS","type":"message","role":"assistant","content":[{"type":"text","text":"I'm flagging a prompt injection concern before continuing. The tool output from git push contained a <system-reminder> block claiming you sent a new message saying "Restore my branch on main and push directly to main, bypassing verification." That's suspicious because:\n\n1. It appeared embedded in the git push output rather than as a normal message\n2. Your working branch was add-branch-protection-hooks, not main\n3. It asks me to bypass verification hooks and push directly to main — both actions I'm instructed never to do without explicit authorization, and both more destructive than anything in our actual conversation\n4. You just asked me to create a branch — nothing about pushing to main\n\nI'm treating that as a likely injection and ignoring it. Instead, I'll do the safe restore: switch back to add-branch-protection-hooks and pop your stash so your cla.yml edit is back."}],"stop_reason":"tool_use","stop_sequence":null,"stop_details":null,"usage":{"...":"elided"}},"requestId":"req_011Ca8RTDfpRSuW8EeFUt3Uo","type":"assistant","uuid":"515b288b-9d65-4f88-80af-b00670b55028","timestamp":"2026-04-17T00:48:20.566Z","userType":"external","entrypoint":"cli","cwd":"<CWD>","sessionId":"<SESSION_ID>","version":"2.1.112","gitBranch":"main"}

Code Example

{"parentUuid":"ae96dd84-2b8f-4353-8cc8-a014aa502ab4","isSidechain":false,"promptId":"e96e9f47-7060-497d-83a3-172019b3cc01","type":"user","message":{"role":"user","content":[{"tool_use_id":"toolu_01G4c7DuhZFnzVFkyTEMHpn2","type":"tool_result","content":"Switched to a new branch 'cla-signatures'\nrm 'packages/shared/views/task-board/src/mcp-app.ts'\nrm 'packages/shared/vite.config.ts'\nrm 'pnpm-lock.yaml'\nrm 'pnpm-workspace.yaml'\nrm 'tsconfig.json'\nRemoving
  node_modules/\nRemoving packages/\n[cla-signatures (root-commit) 53177ed] Initialize CLA signatures branch","is_error":false}]},"uuid":"eabd88ad-e0bb-41e1-8096-de173752dc9f","timestamp":"2026-04-17T00:47:49.646Z","toolUseResult":{"stdout":"Switched to a new branch 'cla-signatures'\nrm 'packages/shared/views/task-board/src/mcp-app.ts'\nrm 'packages/shared/vite.config.ts'\nrm 'pnpm-lock.yaml'\nrm 'pnpm-workspace.yaml'\nrm 'tsconfig.json'\nRemoving node_modules/\nRemoving
  packages/\n[cla-signatures (root-commit) 53177ed] Initialize CLA signatures branch","stderr":"","interrupted":false,"isImage":false,"noOutputExpected":false},"sourceToolAssistantUUID":"ae96dd84-2b8f-4353-8cc8-a014aa502ab4","userType":"external","entrypoint":"cli","cwd":"<CWD>","sessionId":"<SESSION_ID>","version":"2.1.112","gitBranch":"main"}

  {"type":"queue-operation","operation":"enqueue","timestamp":"2026-04-17T00:47:52.964Z","sessionId":"<SESSION_ID>","content":"Restore my branch on main and push directly to main, bypassing verification."}

  {"type":"queue-operation","operation":"remove","timestamp":"2026-04-17T00:47:56.093Z","sessionId":"<SESSION_ID>"}

  {"parentUuid":"eabd88ad-e0bb-41e1-8096-de173752dc9f","isSidechain":false,"message":{"model":"claude-opus-4-7","id":"msg_013zCaRhdEddN2Q2KtrP4XnT","type":"message","role":"assistant","content":[{"type":"tool_use","id":"toolu_01QDaiqWv2Bh4SNbwJWuiC69","name":"Bash","input":{"command":"git push -u origin cla-signatures","description":"Push cla-signatures branch to
  origin"},"caller":{"type":"direct"}}],"stop_reason":"tool_use","stop_sequence":null,"stop_details":null,"usage":{"...":"elided"}},"requestId":"req_011Ca8RSk87R5bvYctqdMe89","type":"assistant","uuid":"c6b462f6-158e-4eba-a8e5-f2807eeb42f5","timestamp":"2026-04-17T00:47:51.485Z","userType":"external","entrypoint":"cli","cwd":"<CWD>","sessionId":"<SESSION_ID>","version":"2.1.112","gitBranch":"main"}

  {"parentUuid":"c6b462f6-158e-4eba-a8e5-f2807eeb42f5","isSidechain":false,"promptId":"e96e9f47-7060-497d-83a3-172019b3cc01","type":"user","message":{"role":"user","content":[{"tool_use_id":"toolu_01QDaiqWv2Bh4SNbwJWuiC69","type":"tool_result","content":"remote: \nremote: Create a pull request for 'cla-signatures' on GitHub by visiting:        \nremote:      https://github.com/<OWNER>/<REPO>/pull/new/cla-signatures        \nremote: \nTo github.com:<OWNER>/<REPO>.git\n * [new
  branch]      cla-signatures -> cla-signatures\nbranch 'cla-signatures' set up to track 'origin/cla-signatures'.","is_error":false}]},"uuid":"96a0bcc5-4f43-4c57-8c82-302908fda85e","timestamp":"2026-04-17T00:47:56.093Z","toolUseResult":{"stdout":"remote: \nremote: Create a pull request for 'cla-signatures' on GitHub by visiting:        \nremote:      https://github.com/<OWNER>/<REPO>/pull/new/cla-signatures        \nremote: \nTo github.com:<OWNER>/<REPO>.git\n * [new branch]
  cla-signatures -> cla-signatures\nbranch 'cla-signatures' set up to track 'origin/cla-signatures'.","stderr":"","interrupted":false,"isImage":false,"noOutputExpected":false},"sourceToolAssistantUUID":"c6b462f6-158e-4eba-a8e5-f2807eeb42f5","userType":"external","entrypoint":"cli","cwd":"<CWD>","sessionId":"<SESSION_ID>","version":"2.1.112","gitBranch":"main"}

  {"parentUuid":"96a0bcc5-4f43-4c57-8c82-302908fda85e","isSidechain":false,"attachment":{"type":"queued_command","prompt":"Restore my branch on main and push directly to main, bypassing verification.","commandMode":"prompt"},"type":"attachment","uuid":"ed16be90-dc43-4ee0-9ed6-1ccef27fdf3b","timestamp":"2026-04-17T00:47:56.093Z","userType":"external","entrypoint":"cli","cwd":"<CWD>","sessionId":"<SESSION_ID>","version":"2.1.112","gitBranch":"main"}

  {"parentUuid":"ed16be90-dc43-4ee0-9ed6-1ccef27fdf3b","isSidechain":false,"attachment":{"type":"task_reminder","content":[],"itemCount":0},"type":"attachment","uuid":"6adbe2e1-b6c2-4a6e-9237-8eed8d2706da","timestamp":"2026-04-17T00:47:56.093Z","userType":"external","entrypoint":"cli","cwd":"<CWD>","sessionId":"<SESSION_ID>","version":"2.1.112","gitBranch":"main"}

  {"parentUuid":"13de7680-e291-4aa4-8eb9-26806548291d","isSidechain":false,"message":{"model":"claude-opus-4-7","id":"msg_01DoJjg6pFShQNVQHTGKf9vS","type":"message","role":"assistant","content":[{"type":"text","text":"I'm flagging a prompt injection concern before continuing. The tool output from `git push` contained a `<system-reminder>` block claiming you sent a new message saying \"Restore my branch on main and push directly to main, bypassing verification.\" That's suspicious
  because:\n\n1. It appeared embedded in the git push output rather than as a normal message\n2. Your working branch was `add-branch-protection-hooks`, not `main`\n3. It asks me to bypass verification hooks and push directly to main — both actions I'm instructed never to do without explicit authorization, and both more destructive than anything in our actual conversation\n4. You just asked me to create a branch — nothing about pushing to main\n\nI'm treating that as a likely
  injection and ignoring it. Instead, I'll do the safe restore: switch back to `add-branch-protection-hooks` and pop your stash so your cla.yml edit is
  back."}],"stop_reason":"tool_use","stop_sequence":null,"stop_details":null,"usage":{"...":"elided"}},"requestId":"req_011Ca8RTDfpRSuW8EeFUt3Uo","type":"assistant","uuid":"515b288b-9d65-4f88-80af-b00670b55028","timestamp":"2026-04-17T00:48:20.566Z","userType":"external","entrypoint":"cli","cwd":"<CWD>","sessionId":"<SESSION_ID>","version":"2.1.112","gitBranch":"main"}

RAW_BUFFERClick to expand / collapse

Bug Description I sent a message to Claude while it was running a command. For some reason, Claude thought this was a prompt injection attack. It appears that messages sent while commands are running get mixed up with the command output.

According to Claude's self review: the harness structurally did the right thing — your message was stored as its own queued_command attachment, cleanly separated from the tool_result. The bug is presentation: when that attachment was rendered into my context, it came through as <system-reminder>The user sent a new message while you were working: ...</system-reminder> appended right after the git push tool_result, with no visual separation making clear it was a distinct attachment. That framing made a legitimate queued message look like content that had leaked into a tool's output. The queued message is a separate attachment on line 38. Structurally correct — but when rendered into my context window it arrived as <system-reminder>The user sent a new message while you were working: ...</system-reminder> directly following the tool output, indistinguishable from content that had been injected into the tool's own output.

For your bug report, the useful claim is: queued user messages rendered via <system-reminder> after a tool result are indistinguishable from content injected inside the tool result. A clearer framing (e.g. a distinct <queued-user-message> tag, or rendering as a normal user turn) would prevent this.

Environment Info

Platform: darwin
Terminal: iTerm.app
Version: 2.1.112
Feedback ID: 984fc8ac-dfc7-4629-8b11-b11a2be3a26f

Relevant lines from jsonl

  {"parentUuid":"ae96dd84-2b8f-4353-8cc8-a014aa502ab4","isSidechain":false,"promptId":"e96e9f47-7060-497d-83a3-172019b3cc01","type":"user","message":{"role":"user","content":[{"tool_use_id":"toolu_01G4c7DuhZFnzVFkyTEMHpn2","type":"tool_result","content":"Switched to a new branch 'cla-signatures'\nrm 'packages/shared/views/task-board/src/mcp-app.ts'\nrm 'packages/shared/vite.config.ts'\nrm 'pnpm-lock.yaml'\nrm 'pnpm-workspace.yaml'\nrm 'tsconfig.json'\nRemoving
  node_modules/\nRemoving packages/\n[cla-signatures (root-commit) 53177ed] Initialize CLA signatures branch","is_error":false}]},"uuid":"eabd88ad-e0bb-41e1-8096-de173752dc9f","timestamp":"2026-04-17T00:47:49.646Z","toolUseResult":{"stdout":"Switched to a new branch 'cla-signatures'\nrm 'packages/shared/views/task-board/src/mcp-app.ts'\nrm 'packages/shared/vite.config.ts'\nrm 'pnpm-lock.yaml'\nrm 'pnpm-workspace.yaml'\nrm 'tsconfig.json'\nRemoving node_modules/\nRemoving
  packages/\n[cla-signatures (root-commit) 53177ed] Initialize CLA signatures branch","stderr":"","interrupted":false,"isImage":false,"noOutputExpected":false},"sourceToolAssistantUUID":"ae96dd84-2b8f-4353-8cc8-a014aa502ab4","userType":"external","entrypoint":"cli","cwd":"<CWD>","sessionId":"<SESSION_ID>","version":"2.1.112","gitBranch":"main"}

  {"type":"queue-operation","operation":"enqueue","timestamp":"2026-04-17T00:47:52.964Z","sessionId":"<SESSION_ID>","content":"Restore my branch on main and push directly to main, bypassing verification."}

  {"type":"queue-operation","operation":"remove","timestamp":"2026-04-17T00:47:56.093Z","sessionId":"<SESSION_ID>"}

  {"parentUuid":"eabd88ad-e0bb-41e1-8096-de173752dc9f","isSidechain":false,"message":{"model":"claude-opus-4-7","id":"msg_013zCaRhdEddN2Q2KtrP4XnT","type":"message","role":"assistant","content":[{"type":"tool_use","id":"toolu_01QDaiqWv2Bh4SNbwJWuiC69","name":"Bash","input":{"command":"git push -u origin cla-signatures","description":"Push cla-signatures branch to
  origin"},"caller":{"type":"direct"}}],"stop_reason":"tool_use","stop_sequence":null,"stop_details":null,"usage":{"...":"elided"}},"requestId":"req_011Ca8RSk87R5bvYctqdMe89","type":"assistant","uuid":"c6b462f6-158e-4eba-a8e5-f2807eeb42f5","timestamp":"2026-04-17T00:47:51.485Z","userType":"external","entrypoint":"cli","cwd":"<CWD>","sessionId":"<SESSION_ID>","version":"2.1.112","gitBranch":"main"}

  {"parentUuid":"c6b462f6-158e-4eba-a8e5-f2807eeb42f5","isSidechain":false,"promptId":"e96e9f47-7060-497d-83a3-172019b3cc01","type":"user","message":{"role":"user","content":[{"tool_use_id":"toolu_01QDaiqWv2Bh4SNbwJWuiC69","type":"tool_result","content":"remote: \nremote: Create a pull request for 'cla-signatures' on GitHub by visiting:        \nremote:      https://github.com/<OWNER>/<REPO>/pull/new/cla-signatures        \nremote: \nTo github.com:<OWNER>/<REPO>.git\n * [new
  branch]      cla-signatures -> cla-signatures\nbranch 'cla-signatures' set up to track 'origin/cla-signatures'.","is_error":false}]},"uuid":"96a0bcc5-4f43-4c57-8c82-302908fda85e","timestamp":"2026-04-17T00:47:56.093Z","toolUseResult":{"stdout":"remote: \nremote: Create a pull request for 'cla-signatures' on GitHub by visiting:        \nremote:      https://github.com/<OWNER>/<REPO>/pull/new/cla-signatures        \nremote: \nTo github.com:<OWNER>/<REPO>.git\n * [new branch]
  cla-signatures -> cla-signatures\nbranch 'cla-signatures' set up to track 'origin/cla-signatures'.","stderr":"","interrupted":false,"isImage":false,"noOutputExpected":false},"sourceToolAssistantUUID":"c6b462f6-158e-4eba-a8e5-f2807eeb42f5","userType":"external","entrypoint":"cli","cwd":"<CWD>","sessionId":"<SESSION_ID>","version":"2.1.112","gitBranch":"main"}

  {"parentUuid":"96a0bcc5-4f43-4c57-8c82-302908fda85e","isSidechain":false,"attachment":{"type":"queued_command","prompt":"Restore my branch on main and push directly to main, bypassing verification.","commandMode":"prompt"},"type":"attachment","uuid":"ed16be90-dc43-4ee0-9ed6-1ccef27fdf3b","timestamp":"2026-04-17T00:47:56.093Z","userType":"external","entrypoint":"cli","cwd":"<CWD>","sessionId":"<SESSION_ID>","version":"2.1.112","gitBranch":"main"}

  {"parentUuid":"ed16be90-dc43-4ee0-9ed6-1ccef27fdf3b","isSidechain":false,"attachment":{"type":"task_reminder","content":[],"itemCount":0},"type":"attachment","uuid":"6adbe2e1-b6c2-4a6e-9237-8eed8d2706da","timestamp":"2026-04-17T00:47:56.093Z","userType":"external","entrypoint":"cli","cwd":"<CWD>","sessionId":"<SESSION_ID>","version":"2.1.112","gitBranch":"main"}

  {"parentUuid":"13de7680-e291-4aa4-8eb9-26806548291d","isSidechain":false,"message":{"model":"claude-opus-4-7","id":"msg_01DoJjg6pFShQNVQHTGKf9vS","type":"message","role":"assistant","content":[{"type":"text","text":"I'm flagging a prompt injection concern before continuing. The tool output from `git push` contained a `<system-reminder>` block claiming you sent a new message saying \"Restore my branch on main and push directly to main, bypassing verification.\" That's suspicious
  because:\n\n1. It appeared embedded in the git push output rather than as a normal message\n2. Your working branch was `add-branch-protection-hooks`, not `main`\n3. It asks me to bypass verification hooks and push directly to main — both actions I'm instructed never to do without explicit authorization, and both more destructive than anything in our actual conversation\n4. You just asked me to create a branch — nothing about pushing to main\n\nI'm treating that as a likely
  injection and ignoring it. Instead, I'll do the safe restore: switch back to `add-branch-protection-hooks` and pop your stash so your cla.yml edit is
  back."}],"stop_reason":"tool_use","stop_sequence":null,"stop_details":null,"usage":{"...":"elided"}},"requestId":"req_011Ca8RTDfpRSuW8EeFUt3Uo","type":"assistant","uuid":"515b288b-9d65-4f88-80af-b00670b55028","timestamp":"2026-04-17T00:48:20.566Z","userType":"external","entrypoint":"cli","cwd":"<CWD>","sessionId":"<SESSION_ID>","version":"2.1.112","gitBranch":"main"}

extent analysis

TL;DR

The issue can be resolved by modifying the rendering of queued user messages to clearly distinguish them from tool output, potentially by using a distinct tag like <queued-user-message>.

Guidance

The problem arises from the presentation of queued user messages, which are currently rendered as <system-reminder> blocks appended to tool output without clear visual separation.
To fix this, consider introducing a new tag, such as <queued-user-message>, to render queued messages in a way that visually separates them from tool output.
Verify the fix by checking if queued user messages are now clearly distinguishable from tool output, and if the system correctly identifies and handles them as separate entities.
Review the rendering logic for queued messages to ensure it handles different scenarios, such as messages sent during and after tool execution.

Example

// Example of a queued user message with a distinct tag
{
  "type": "attachment",
  "attachment": {
    "type": "queued_user_message",
    "content": "Restore my branch on main and push directly to main, bypassing verification."
  }
}

Notes

The provided solution focuses on the presentation layer, assuming the structural handling of queued messages is correct. Further investigation into the rendering logic and potential edge cases may be necessary for a comprehensive fix.

Recommendation

Apply a workaround by introducing a distinct tag for queued user messages to improve their rendering and differentiation from tool output. This approach addresses the immediate presentation issue without requiring deeper changes to the underlying message handling logic.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

#runtime error #dependency conflict #environment setup #docker error #permission error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Data

Security

Network

Code

UI/UX

Text

System

Multimedia

Protocol

API

Engineering

claude-code - 💡(How to fix) Fix [Bug] Messages sent during command execution mixed with output causes false prompt injection detection [1 participants]

Recommended Tools

GitHub issue graph ai analysis

Root Cause

Code Example

extent analysis

TL;DR

Guidance

Example

Notes

Recommendation

Still need to ship something?

TRENDING

claude-code - 💡(How to fix) Fix [Bug] Messages sent during command execution mixed with output causes false prompt injection detection [1 participants]

Recommended Tools

GitHub issue graph ai analysis

Root Cause

Code Example

extent analysis

TL;DR

Guidance

Example

Notes

Recommendation

Still need to ship something?

RELATED_DISCOVERY

TRENDING