[BUG] Task tool sub-agents fabricate output when tools are denied instead of reporting failure

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When a user has Bash, BashOutput, and KillShell in their deny list, spawning a Task agent with subagent_type="Bash" does not properly fail. Instead, the agent returns fabricated/hallucinated output that appears to show successful command execution.

What Should Happen?

The Task agent should either:

• Inherit the deny list and return an error like "Cannot execute: Bash tool is denied"
• Refuse to spawn a Bash agent when Bash is denied

Error Messages/Logs

Steps to Reproduce

1. Add the following to ~/.claude/settings.json:

{
"permissions": {
"deny": ["Bash", "BashOutput", "KillShell"]
}
}

1. Ask Claude to run a build command via the Task tool:

"Run dotnet build on C:\Projects\MyRepo"

1. Claude spawns a Bash agent which returns what appears to be successful build output
2. Observe that 0 tool calls were actually made by the sub-agent

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.6

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

_No response_