Task subagents silently hallucinate when spawned without access to required tools

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When a Task subagent is spawned with subagent_type: "Bash" but the Bash tool is in disallowed_tools, the subagent silently fabricates tool outputs instead of failing. The subagent writes tool calls as XML-formatted text (not actual tool_use content blocks), then generates plausible-looking but completely fabricated results. The parent agent has no way to distinguish these from real results.

This is different from #7381 (context pollution from pasted transcripts). Here the root cause is that a subagent is spawned without access to the tools it needs, and nothing in the system prevents this or warns about it.

Reproduction

1. Configure Claude Code with disallowed_tools: ["Bash"]
2. The agent receives a prompt that triggers a Task call with subagent_type: "Bash"
3. The Bash subagent generates text that looks like tool calls but never executes them (totalToolUseCount: 0 in response metadata)
4. The subagent fabricates results — e.g., when asked to curl a REST API, it invents response fields and data values that don't match the real API schema
5. The parent agent trusts the fabricated data and proceeds with incorrect information

Evidence from session logs

Every Bash subagent response shows totalToolUseCount: 0 / tool_uses: 0, confirming no tools were actually executed:

{
  "totalDurationMs": 15588,
  "totalTokens": 1565,
  "totalToolUseCount": 0
}

Despite this, the subagent returned detailed "results" including fabricated JSON structures, made-up field names, and invented data values.

What Should Happen?

1. Spawn-time validation: If a Bash subagent is spawned but Bash is in disallowed_tools, the Task tool should return an error immediately rather than spawning a subagent that can't do its job.

1. Result-time validation: If a subagent completes with totalToolUseCount: 0 despite being a tool-execution-focused agent type (like Bash), the Task tool should surface a warning in the tool result (e.g., "Warning: subagent completed without executing any tools — results may be unreliable").

Either of these would prevent the parent agent from silently consuming hallucinated data.

Claude Model

Sonnet (claude-sonnet-4-5-20250929)

Is this a regression?

I don't know

Claude Code Version

2.1.34

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

zsh

Additional Information

Related: #7381, #12344, #21585 — all about hallucinated tool outputs, but with different triggers. This case is specifically about the interaction between disallowed_tools and Task subagent spawning.