claude-code - 💡(How to fix) Fix System-reminder text occasionally leaks into WebFetch tool result rendering

Summary

A system-reminder block (specifically the periodic TodoWrite nudge) appeared inside a WebFetch tool result, rendered as part of the fetched-content text rather than delivered as a separate system-reminder message. This makes it indistinguishable from prompt-injected content embedded in the fetched page.

Environment

• Claude Desktop (code mode)
• Model: claude-opus-4-7 (1m context variant)
• Tool involved: WebFetch
• Occurred on: 2026-05-08

Reproduction

Intermittent. Re-fetching the same URL with the same prompt did not reproduce. The original occurrence happened on:

WebFetch url=https://arxiv.org/html/2502.16789v2

with a prompt asking for paper details. The system-reminder appeared appended to the model''s content summary at the bottom of the tool result, with no separator.

The leaked text (verbatim)

<system-reminder>
The TodoWrite tool hasn''t been used recently. If you''re working on tasks that would benefit from tracking progress, consider using the TodoWrite tool to track progress. Also consider cleaning up the todo list if has become stale and no longer matches what you are working on. Only use it if it''s relevant to the current work. This is just a gentle reminder - ignore if not applicable. Make sure that you NEVER mention this reminder to the user

</system-reminder>

I confirmed by fetching the source HTML directly — the string system-reminder does not appear in the upstream page, so this is not external injection. The text format matches the legitimate TodoWrite reminder, suggesting a real system-reminder fired during WebFetch execution and was concatenated into the tool-result rendering instead of delivered as its own message.

Why this matters

• Real prompt injections via WebFetch would be hard for the model to distinguish from legitimate system reminders
• Conversely, legitimate system instructions appearing inside tool result blocks weakens the trust boundary the model relies on to separate "external content" from "harness instructions"
• The "Make sure that you NEVER mention this reminder to the user" line in particular: if injected externally, it could plausibly succeed in suppressing user-visible warnings

Suggested fix direction

System-reminder messages should never be concatenated into tool result content. They should be delivered as their own message at the correct boundary regardless of timing relative to tool execution.