[MODEL] Subagent findings relayed to user without verification — poor prompt context causes false positives and token waste

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information

Type of Behavior Issue

Subagent behaved unexpectedly

What I Asked Claude to Do

I asked Claude Code (Opus) to review an implementation branch against a design spec and implementation plan. The codebase includes a Next.js 16 dashboard app.

What Claude Actually Did

1. Dispatched a code-reviewer subagent to review the implementation
2. The subagent prompt did not include dependency version context (the dashboard uses Next.js 16, React 19, Tailwind 4) — this was Claude's own fault in constructing the prompt
3. The subagent flagged proxy.ts as a "critical" bug, claiming it should be middleware.ts — but proxy.ts is the correct convention in Next.js 16 (middleware.ts was deprecated)
4. The subagent also flagged two "important" issues in actions.ts (missing slug validation, missing teardown guard)
5. Claude presented all 3 findings directly to the user without reading the flagged files to verify any of them
6. User corrected the proxy.ts finding
7. Claude then still didn't verify the remaining 2 findings — waited for the user to explicitly say "verify them first"
8. Upon reading the actual code (~30 seconds), both remaining findings were also non-issues:

• Slug validation: already handled by manifest lookup on line 84 (slug must match an existing app directory)
• Teardown guard: allowing teardown of "creating"/"building" states is correct behavior (lets users clean up stuck deploys)

1. Total: 3 false findings, ~3 wasted round trips, significant token waste

Token Waste Estimate

• Review subagent: 84,452 tokens (from subagent metadata)
• Main conversation waste (presenting false findings, user corrections, Context7 lookup to confirm what user already said, "want me to fix?" for non-issues, user telling me to verify, reading files and confirming non-issues, apology round trips): ~20-30k tokens
• Total estimated waste: ~100-120k tokens
• What it would have cost to verify first: ~5k tokens (reading the 3 flagged files before reporting)

Expected Behavior

1. When constructing a subagent prompt, Claude should include key dependency versions from the project's package.json — it had already read this file earlier in the conversation
2. When subagent results come back, Claude should read the flagged files and verify each finding before presenting to the user — especially anything labeled "critical"
3. After the user corrects one false finding, Claude should immediately verify the remaining findings rather than presenting them as still valid and waiting to be told to check

Files Affected

Read (by subagent, with incorrect conclusions):

• apps/dashboard/src/proxy.ts — flagged as wrong filename (correct for Next.js 16)
• apps/dashboard/src/app/actions.ts — 2 false issues flagged (slug validation and teardown guard both already handled)
• apps/dashboard/package.json — contains "next": "^16.2.2" which explains the proxy.ts convention, but subagent was not told to check this

Permission Mode

Accept Edits was OFF (manual approval required)

Can You Reproduce This?

Haven't tried to reproduce

Claude Model

Opus

Relevant Conversation

After dispatching the review subagent, Claude presented findings:

| Priority | Issue | File | |----------|-------|------| | Critical | proxy.ts should be middleware.ts with export named middleware — auth gate is completely bypassed | proxy.ts | | Important | No slug validation — crafted slug could create unexpected subdomains | actions.ts | | Important | teardownApp doesn't guard against "creating"/"building" states | actions.ts |

User: "I think proxy is used by Next.js 16?"

Claude then looked up Next.js 16 docs and confirmed the user was right. User then asked about the remaining findings. Claude said "Want me to fix these?" — still without having verified them.

User: "Idk. Verify them first"

Claude read the file and confirmed both were non-issues in 30 seconds.

Impact

Medium - Extra work to undo changes (wasted time and tokens on false findings across multiple round trips)

Claude Code Version

2.1.76 (Claude Code)

Platform

Anthropic API

Additional Context

The core issue is two-fold:

1. Poor subagent prompt construction: Claude had already read package.json showing Next.js 16, but didn't include this context in the review subagent prompt. The subagent can only work with what it's given.

1. No verification before reporting: Checking each finding against the actual code takes ~30 seconds (~5k tokens). Claude should do this automatically rather than passing unverified claims to the user. After the first false positive was caught, Claude should have immediately verified the rest rather than continuing to present them as valid.

This is fundamentally a model behavior issue — Claude chose to relay findings without verification, and chose to construct a subagent prompt without sufficient context, despite having that context available in conversation history.