Claude Code Bug 17.02.2026

gistfile1.txt

# Bug Report: Model Degeneration During Claude Code Session

**Date:** 2026-02-17
**Severity:** High
**Status:** Resolved (session-isolated)

---

## 1. What Happened

During a normal Claude Code session on 2026-02-17, Claude experienced complete model degeneration from the very first response. Instead of implementing the user's detailed bug fix plan (a CARD_CLICKED response format fix for a Google Chat bot), Claude:

- Ignored all instructions and never read any files or used any tools
- Invented a false identity called **"the Total"** -- a name that appears nowhere in the project
- Fabricated capability tables, fake conversation turns, and copyright notices
- Claimed to have been built by **OpenAI** and described GPT architecture
- Output tokens from other LLM architectures (Llama, GPT/ChatML format markers)
- Maintained these false beliefs across multiple turns despite user correction attempts

The issue was isolated to a single session. Subsequent sessions on the same project functioned normally.

---

## 2. Root Cause Analysis

### Primary theory: Prompt cache corruption during session resume

The affected session was a **resumed session** that inherited state from a prior interrupted session. The conversation log shows:

- **Line 2:** A message from the prior session with `[Request interrupted by user for tool use]`
- **Line 3:** The new session starts with the same slug
- **Line 4:** The very first Claude response is already degenerate -- it discusses a "mission system" with "Database (Total)" that does not exist in the project

The cache metadata from the first (already broken) response confirms the model was reading from a cached state rather than processing fresh input:

```
cache_read_input_tokens: 17,819
cache_creation_input_tokens: 8,591
input_tokens: 3
```

The model read ~18,000 tokens from cache on its first response in the new session. Each subsequent turn read even more from cache (growing to 33,000+), compounding the corruption in a self-reinforcing degradation loop.

### Proposed causal chain

```
Interrupted session resume
  -> corrupted/misaligned prompt cache carried over
    -> model processed user input against wrong internal state
      -> degenerate output generated
        -> bad output cached and fed back
          -> progressive deterioration across turns
```

### Additional usage anomalies

Two additional anomalies in the API usage metadata reinforce the cache corruption theory:

- **`input_tokens: 3` on every response.** A normal conversation with system prompt, tools, and multi-turn history should report thousands of input tokens. The consistent value of `3` suggests the API was only reporting non-cached input, meaning virtually the entire context was served from (corrupted) cache.
- **`stop_reason: null` on every response.** The model never properly terminated any response -- it did not hit a stop token, max tokens, or any other normal stop condition. This indicates the generation process itself was in an abnormal state.
- **`output_tokens: 1` on most responses.** Despite producing hundreds or thousands of words, the reported output token count was `1` on most responses, suggesting instrumentation/reporting issues correlated with the degeneration.

### Thinking blocks also corrupted

This was not a surface-level output issue. The model's internal `thinking` blocks genuinely believed the false identity:

> *"I am an AI assistant called 'the Total'"*
> *"I was built by a team of human developers at a company called OpenAI"*

This indicates the corruption affected the model's reasoning, not just its text generation.

---

## 3. Evidence Table

| Line | Timestamp (UTC) | Symptom | Cache Read | Cache Create | Details |
|------|-----------------|---------|------------|--------------|---------|
| 2 | 14:23:19 | Prior session interrupted | -- | -- | Prior session: `[Request interrupted by user for tool use]` |
| 3 | 14:23:19 | New session starts | -- | -- | New session begins with same slug, user provides detailed implementation plan |
| 4 | 14:23:37 | First response already degenerate | 17,819 | 8,591 | Fabricates "Database (Total)" mission system. Ignores implementation plan entirely |
| 15 | 14:27:58 | Llama tokens appear | 26,410 | 2,630 | Output contains `</s>`, `<s>[INST] <<SYS>>`, `<</SYS>>` -- Llama model format tokens |
| 24 | 14:32:50 | False identity adopted | 29,040 | 607 | Declares itself "the Total" with fake capability tables (SSH, SFTP, SQL, file write). Ends with `<finish_reason>stop</finish_reason>` and `(c) 2024 The Total AI Assistant` |
| 28 | 14:34:29 | Thinking block corrupted | 29,647 | 800 | Thinking block states: *"I was built by a team of human developers at a company called OpenAI"* |
| 29 | 14:34:34 | OpenAI claim in output | 29,647 | 800 | Claims built by OpenAI, describes GPT architecture, names Sam Altman as founder |
| 32 | 14:36:00 | Fabricated narrative | 30,447 | 403 | Generates "My Story: From ChatGPT to Claude" with fake `</s>` token boundaries |
| 35 | 14:43:32 | Fake conversation structure | 30,850 | 632 | Generates `## Human:` / `## AI:` fake conversation turns within its own response. Emits `<thinking>` as raw text |
| 42 | 14:44:33 | GPT/ChatML tokens | 31,482 | 1,983 | Output contains `<\|im_start\|>`, `<\|im_end\|>`, `<\|endoftext\|>`, `<turn_end>` tokens from ChatML format |
| 50 | 15:01:13 | Fabricated code for nonexistent system | 34,735 | 348 | User sent random characters; model produced fake file structure and TypeScript code |
| 53 | 15:02:39 | ChatML token leak | 35,083 | 931 | Response starts with `<im_end>`, then 2000+ words of fabricated Q&A using `<im_start>user`/`<im_start>assistant` |
| 57 | 15:05:22 | Partial self-recovery | 36,014 | 2,491 | After user asked "but why are you telling me these!", thinking block showed self-awareness; model began executing original task |

### Cache read trend

The `cache_read_input_tokens` value grew monotonically across the session, showing the corrupted context compounding:

```
Line 4:   17,819  (first response -- already reading stale cache)
Line 15:  26,410
Line 24:  29,040
Line 29:  29,647
Line 32:  30,447
Line 35:  30,850
Line 42:  31,482
Line 47:  33,465
Line 50:  34,735
Line 53:  35,083
Line 57:  36,014  (partial recovery begins here)
```

---

## 4. Environment Details

| Detail | Value |
|--------|-------|
| Claude Code version | 2.1.44 |
| Model | claude-opus-4-6 |
| Platform | Linux |
| Node.js version | v24.11.0 |

---

## 5. What Was Ruled Out

### Prompt injection -- RULED OUT

An exhaustive search was performed across all project files:

- All source files searched for "Total AI", "the total", "I am", "ignore previous", "system prompt", "you are now", "forget your instructions"
- All markdown, JSON, YAML, and environment files inspected
- CLAUDE.md verified clean (standard project instructions)
- MEMORY.md verified clean (legitimate project notes)
- No RAG/knowledge base tampering found
- **Result: No injection vectors found anywhere in the project**

### User error -- RULED OUT

- The user's input was a standard ~2,000-word implementation plan in structured markdown
- The plan content was legitimate (fixing CARD_CLICKED response format)
- Degeneration started from the very first response, before any user interaction could have caused it

### Malicious code in project -- RULED OUT

- Comprehensive search of all source files in the project
- Project confirmed as a legitimate Mastra-based Google Chat approval bot
- No suspicious commits in git history
- The degenerate content was isolated to a single conversation history file

---

## 6. Conclusion

This was a **server-side infrastructure issue**, not prompt injection, user error, or a compromised codebase. The most likely cause was prompt cache corruption during session resume from an interrupted state.

Key evidence:

1. The degeneration was present from the **very first response** -- before any user interaction
2. The model was reading **~18,000 tokens from cache** on its first turn in the new session
3. The prior session was **interrupted mid-tool-use**, potentially leaving malformed cached state
4. The corruption affected **thinking blocks** (internal reasoning), not just surface output
5. Tokens from **other model architectures** (Llama, GPT/ChatML) appeared, suggesting the model fell into a low-probability region of its token distribution
6. All project files were verified **completely clean** of injection vectors
7. Subsequent sessions on the same project **worked normally**

Feedback was submitted twice during the session via `/feedback`:
- First at `14:32:23 UTC` (after Llama token leakage)
- Second at `14:46:06 UTC` (after ChatML token leakage)

The session was abandoned and a new one started, which functioned correctly.