[BUG] Task tool subagents hallucinate Bash command outputs instead of receiving actual results

Description

Subagents spawned via the Task tool hallucinate Bash command outputs instead of receiving actual execution results. The subagent appears to "predict" expected output rather than using real Bash results.

Environment

• Claude Code version: Latest (VS Code extension)
• OS: macOS Darwin 24.6.0
• Model: claude-opus-4-5-20251101

Steps to Reproduce

1. Create a custom agent with Bash tool enabled:

---
name: test-bash
description: Test agent for Bash tool
tools:
  - Bash
  - Read
  - Glob
model: inherit
---

1. Invoke via Task tool:

Task(
  subagent_type="test-bash",
  prompt="Run: ls /path/to/your/project/src and report the exact output"
)

1. Compare subagent's reported output with actual directory contents

Expected Behavior

Subagent should return the actual Bash command output:

components
hooks
index.ts
utils
services

Actual Behavior

Subagent returns fabricated output that changes on each invocation:

Run 1:

__tests__
constants
errors.ts
index.ts
lib

Run 2:

api
config
index.ts
models
routes
types.ts
validators

Run 3:

__tests__
calculator
context
domain
forms
index.ts
lottery

None of these directories exist. The output is completely hallucinated.

Key Findings

| Method | Works? | Notes |
|--------|--------|-------|
| Parent agent → Bash | ✅ Yes | Direct execution works correctly |
| Parent agent → Codex MCP | ✅ Yes | Independent process, correct results |
| Task subagent → Read/Glob | ✅ Yes | File reading works correctly |
| Task subagent → Bash | ❌ No | Hallucinated output |

Verification Method

We ran the same ls command via:

1. Task subagent (hallucinated)
2. Parent agent directly (correct)
3. Codex MCP (correct)

The subagent reported different fictional directories each time, while parent agent and Codex MCP consistently returned the correct result.

Impact

This bug breaks any subagent that relies on Bash for:

• Git operations (commit, status, log)
• Test execution (npm test, pnpm test)
• Build verification
• Any shell command validation

Workaround

Use Codex MCP instead of Bash within subagents, or have the parent agent execute Bash commands directly.

Additional Context

• Read, Glob, and Grep tools work correctly in subagents
• Git commands (branch, log, commit hash) sometimes appear correct but file system commands are fabricated
• The hallucination is not deterministic - different fictional output each run