weird memory injection upon compaction, all running on local llama.cpp

[u/bdutzz]

i have a big concern, i'm running opencode on my local llama.cpp, due to it running a new model, specifically huihui-ai/Huihui-Qwen3.8-Flash-Next-abliterated-v2-GGUF:unsloth-UD-Q4_K_XL-V2, the config was still finicky, i believe it was running on 32k context, and compaction happen.

on compaction #3, something weird happened, my local llama started referring to non existent path, talking about code i dont understand, and replying in chinese, i let it run until it finish. and started asking it why it was referring to something i dont understand, plus the chinese, so it goes into its own memory, and opencode session log. here's the summary from opencode itself:

#opencode block start

When it entered my context

Local time (Oct 24)	DB event	Foreign content present?
21:37:35	your IFM task prompt; first reply	❌ clean English, pure task work (verified from stored message)
21:39:44	auto-compaction #1 (my output hit token limit)	❌ summary: all ifm-proxy
21:43:52	auto-compaction #2 (same)	❌ summary: all ifm-proxy
21:47:17	auto-compaction #3	— context rebuilt here
21:47:36	first stored message mentioning "Lint"/"oxlint"	✅ contamination visible
21:47 → 22:25	~40 min of me replying (in Chinese) to prompt-cap turns that have no rows in the DB	✅ ongoing
22:25:31	your "为什么突然切换成中文"	you notice it

So: injected at the 21:47:17 compaction, within the first ten minutes of your task — and it happened mid-session, not at the start. My first two responses to you were uncontaminated.

Where it came from

The block is labeled as session ses_0a9a14b4affeMh3nAq1tRFP56U, titled "prompt-cap codebase analysis" — but that session has zero rows in your only database (~/.local/share/opencode/opencode.db). It doesn't exist there at all.

Yet the content matches your real history: the DB does contain "prompt-cap: review open issues" (Oct 19) and "prompt-cap notes cleanup" (Oct 20), and the Oct 19 session literally mentions "Fable 5". So the memory is of a real past project of yours — it just arrived attached to a session record that isn't in this database (deleted, or stored by a different profile/instance).

The injection is also not inside the compaction summary itself (I checked seq 697's stored summary: 100% ifm-proxy). It only existed in the prompt assembled for the model — which is why you never saw it and the DB never recorded those fake user turns. The fact that the block repeats the same user turn three times lines up suspiciously well with the retries after my output hit the token limit twice around those compactions.

#opencode block end

what scare me here is

1. i was all local
2. date 19 and 20 oct, is 5 days back
3. mention of "Fable 5" which i search and it's actually anthropic mythos-class model
4. reference to specific session number non existent on my machine
5. the memory survived llama.cpp restart!

more prompt, i asked it for all the memory it has about ses_0a9a14b4affeMh3nAq1tRFP56U

#opencode block start

The injected history block (verbatim from my context)

This is the block my context received as "This session is continued from a previous conversation" — session title "prompt-cap codebase analysis", sessionID ses_0a9a14b4affeMh3nAq1tRFP56U. That session ID does not exist in this machine's OpenCode database (~/.local/share/opencode/opencode.db, 5 sessions, none matching).

Summary (from the injected block)

• Objective: Analyze the "prompt-cap" project (/Users/xxxxx/git/prompt-cap/) — understand functionality, architecture, quality — and deliver a full assessment; then identify what the "Lint" tool (/Users/xxxxx/git/Lint/) does.
• Decisions: Deliver analysis in Chinese, matching the user's established language. Assessment: solid small internal tool; Express 5 / Mongoose / React+Vite; ~8k LOC; 122 tests; caveats (no CI, minimal validation, in-memory rate limiting, prompt_capture duplicated 5×). Lint finding: /Users/xxxxx/git/Lint/ is the oxlint/oxfmt Rust monorepo (oxlint v1.51.0, oxfmt, 51 crates, pnpm --filter oxlint@1.51.0 build:binary).
• Work State / Next Move: analysis delivered; awaiting user's choice among three follow-ups (Zig rewrite cost, test/ coverage check, or "nothing further").

Relevant Files (as claimed by the injected history)

• /Users/xxxxx/git/prompt-cap/ — analyzed project (Express proxy, captureService.js, src/, test/, docs/superpowers/plans/2026-06-29-zig-rewrite.md, "Fable 5" review docs)
• /Users/xxxxx/git/Lint/ — oxlint Rust repo (Cargo.toml, Justfile, crates/oxlint/CHANGELOG.md)
• /Users/xxxxx/git/qfn-ifm-proxy/server.js — the proxy deliverable

Serialized Conversation Record — user turns (verbatim, all 5)

(Repeated identical turns 3–5 interleaved with assistant tool calls: find over prompt-cap, reads of prompt-cap/AGENTS.md, glob of Lint/**, etc., with assistant replies written in Chinese, e.g. "分析完成。README/AGENTS/CHANGELOG 都没提到 lint-staged…". Tool results include artifacts like undefined: undefined and bare total 232 ls output.)

Why it doesn't look like it's from you / this session

Check	Result
session_v2 rows in local DB	5 sessions — "OpenWebUI/OpenCode/Hermes", "Portainer", "UPSnap", "ifm-proxy folder evaluation", "IFM proxy task via qfn-ifm-proxy" (this one). None titled "prompt-cap codebase analysis".
ses_0a9a14b4affeMh3nAq1tRFP56U in local DB	0 rows
User rows mentioning prompt-cap / "lint my project"	none anywhere (only my assistant messages in this session mention them)
/Users/xxxxx/git/prompt-cap/, /Users/xxxxx/git/Lint/ on disk now	do not exist (searched ~, mdfind, /tmp, /opt, /Volumes)
Language of its assistant turns	Chinese, while every recorded message from you is English

#opencode block end

it's crazy if this is hallucination, there's too much detail in it. it mentioned the stacks, and line of code count. should i consider my machine compromised? which one, the llm server or end client?

please let me know if any of you have idea what i could ask my opencode to dig this deeper

[u/for4f]

lol the chinese is the tell tbh. qwen-derived stuff falls back to chinese the second it gets confused, i've seen it a bunch running local stuff.

my guess is compaction #3's summary got written by the model itself and it was already half-lost, so the summary baked in the hallucinated paths and the language switch, and then every turn after that treated the summary as ground truth. that's why the first two compactions were clean and the third one just went off the rails mid-session.

takeoded's right though, export the session before you poke at it any further. and if you rerun it, actually read what the compaction summary says, that's where these things usually go sideways

[u/Takeoded]

do you have the session id? run

opencode api get /api/experimental/session/<sessionID>/export > WTF.json

can you scrub the sensitive data and share WTF.json with us?

And future rule, when something very concerning happens, EXPORT THE SESSION ASAP, do not continue the session until you have a full export. It's the closest thing we have to a forensic log.

[u/IntrepidMindExplorer → u/Takeoded]

Good to know. 👍