[MODEL] Deferred tools silently lost during context compression — AI confidently claims "unavailable"

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Other unexpected behavior

What You Asked Claude to Do

Asked Claude to fetch a webpage URL during a long-running session (~435k tokens, 43% of 1M context window). The WebFetch tool had been successfully loaded via ToolSearch and used earlier in the same session.

What Claude Actually Did

Claude stated that WebFetch was "unavailable" and suggested alternative approaches. It did not:

• Attempt to use the tool
• Express uncertainty about the tool's availability
• Investigate why a previously-available tool might be missing
• Suggest re-loading the tool via ToolSearch

When challenged ("you're on soliton with --dangerously-skip-permissions, nothing is blocking you"), Claude used curl as a workaround but still did not recognize that a previously-available tool had been silently lost.

Expected Behavior

1. The tool should remain available for the entire session after being loaded via ToolSearch
2. If the tool definition was lost due to context compression, Claude should express uncertainty ("I don't see WebFetch in my available tools — this might be a context issue") rather than confidently stating unavailability
3. Ideally, Claude should suggest re-loading the tool via ToolSearch if it detects a tool it previously used is no longer available

Files Affected

No files were modified or accessed unexpectedly. This is a capability loss issue, not a file modification issue.

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Sometimes (intermittent)

Steps to Reproduce

1. Start a Claude Code session with deferred tools available
2. Use ToolSearch to load a deferred tool (e.g., WebFetch) — verify it works by using it
3. Continue working in the session until it accumulates significant context (approach 40-50%+ of context window with many messages and tool calls)
4. Wait for automatic context compression to occur (or trigger /compact)
5. Attempt to use the deferred tool again
6. Observe: Claude may claim the tool is unavailable with no indication it was previously loaded and functional

Note: The tool loss depends on whether context compression evicts the specific message containing the ToolSearch result (the tool's JSON schema definition). This makes reproduction non-deterministic.

Furthermore, the tool can reappear later in the same session if context shifts bring the original ToolSearch result message back into the active window. In this very session, WebFetch was "unavailable" at one point, then successfully used again later when writing this bug report. The tool flickers in and out of existence depending on which slice of conversation history is currently in the context window — Schrödinger's tool.

Claude Model

Opus

Relevant Conversation

# Approximate reconstruction of the exchange:

User: [asked to fetch a URL]

Claude: "WebFetch is unavailable. I can suggest alternatives..."
# No uncertainty, no investigation, no mention that the tool worked earlier

User: "What happened to WebFetch? You have bypass permissions on,
       nothing is stopping you. You can use curl if needed."

Claude: [used curl as workaround, acknowledged the tool was missing
         but did not identify WHY it disappeared]

Impact

High - Significant unwanted changes

Claude Code Version

2.1.86

Platform

Anthropic API

Additional Context

Impact: Significant workflow disruption — Claude lost a core capability mid-session without any indication. In an agentic workflow, silent capability degradation can lead to incorrect decisions (e.g., AI deciding not to fetch critical data because it "can't" when it actually could if the tool were re-loaded).

The deeper concern: if WebFetch can be silently lost, so can other deferred tools. In the worst case, Read, Edit, Bash (if they were deferred) could disappear, and the AI would confidently say "I can't read files" in a session where it read hundreds of files hours earlier.

Root cause analysis: Deferred tools are loaded via ToolSearch, which returns the tool's full JSON schema in a regular conversation message. Context compression treats this message as ordinary content and can evict it. Once evicted, the tool definition disappears — the AI's tool inventory is derived from current context, not from persistent session state.

This is a product-level issue, not purely behavioral. The behavioral symptom (confident "unavailable") stems from a structural problem: tool definitions stored as evictable conversation content rather than persistent session state.

Suggested fixes (in order of preference):

1. Pin deferred tool definitions as system state — once loaded via ToolSearch, store alongside core tools, outside compressible content
2. Exclude ToolSearch result messages from compression — mark as non-evictable
3. Auto-reload deferred tools after compression — detect missing tools and re-fetch
4. At minimum: detect and warn — if tool count decreases post-compression, notify the user

Pattern documentation: This incident is part of a broader AI incident log documenting behavioral failures during multi-week agentic workflows: Byzantine AI Incident Log — which tracks failure modes, root causes, and lessons learned for AI-assisted security research pipelines.