Task tool subagent_type="Bash" fabricates command output instead of executing commands

Summary

The Task tool documentation advertises a Bash subagent type described as "Command execution specialist for running bash commands." However, this subagent does not actually execute commands - it's a language model that generates plausible-looking but completely fabricated output.

Impact

• Sub-agent returned fake Gmail data showing wrong email account (fabricated treymossman@gmail.com based on username when actual account was trey@voxemarketing.com)
• Sub-agent fabricated Google Drive search results
• Led to making code changes to a project based on fabricated data from wrong Google Doc
• Hours spent debugging a "broken" auth system that was working correctly the entire time

Steps to Reproduce

1. Use Task tool with subagent_type: "Bash"
2. Ask it to run a command that returns account-specific data (e.g., node gmail-script.js --list)
3. Compare output to running same command via mcp__acp__Bash
4. Outputs will differ - Task/Bash fabricates plausible output, mcp__acp__Bash returns real data

Expected Behavior

Either:

• Remove Bash from available subagent types since it cannot actually execute commands, OR
• Give Bash subagent actual command execution capability via MCP tools, OR
• Clearly document that subagents cannot execute real commands

Current Workaround

Created a PreToolUse hook (subagent-gate.js) that blocks Task calls with subagent_type: "Bash" or subagent_type: "general-purpose" and returns an error message directing to use mcp__acp__Bash instead.

Environment

• Claude Code Version: 2.0.75
• OS: macOS (Darwin 25.2.0)

Additional Context

The Task tool system prompt says:

Available agent types and the tools they have access to:
- Bash: Command execution specialist for running bash commands. Use this for git operations, command execution, and other terminal tasks. (Tools: Bash)

This description implies the Bash subagent can execute commands, but it appears subagents don't have access to MCP tools and simply generate text that looks like command output.