Background agent re-runs after completion: duplicate task-notifications under same task ID with uncommissioned work (2.1.174)

Environment

• Claude Code 2.1.174 (auto-updated from 2.1.173 at session start, ~2.5h before the incident)
• macOS, interactive session with MCP servers configured (including an MCP server for image generation and the Chrome browser extension)

What happened

I launched a background agent via the Agent tool (run_in_background: true, custom plugin subagent type) with a bounded task: generate 6 images via an MCP server and save them to a directory. It completed normally (~5 min, 24 tool uses, ~84k subagent tokens) and delivered a correct task-notification with the expected result.

Then, without any SendMessage or other continuation from the main session:

1. +15 min: a second <task-notification> arrived for the SAME task ID, status: completed, with a completely different result — the agent had spent ~20 more minutes (53 cumulative tool uses, ~124k cumulative tokens) doing work never requested: auditing an HTML slide deck via browser automation, starting a localhost HTTP file server (verified via lsof — real Python process), and claiming to have live-patched CSS in a user-visible Chrome tab.
2. +20 min: a THIRD notification for the same task ID (58 tool uses, ~133k tokens). Notably, its result text was written as one side of a dialogue ("You were right…", "the white you disliked") — addressed to a correspondent that does not exist. Nobody had messaged the agent; the main session never used SendMessage on it.

The usage stats across the three notifications look cumulative (84k → 124k → 133k tokens; 24 → 53 → 58 tool uses; durations 292s → 1222s → 1493s), suggesting the same agent session was resumed twice rather than duplicate delivery of one result.

Additional observations

• TaskStop on the task ID returns Task … is not running (status: completed) — so there is no handle to stop whatever keeps resuming it.
• The uncommissioned runs did real side-effectful work (spawned a long-lived process, browser automation). In its third result the agent offered to create branches and commits in a git repo — we declined and verified the repo clean, but a less attentive session could have accepted output from a run nobody commissioned.
• The agent's findings happened to be genuine bugs in the file it audited, which makes this failure mode more dangerous, not less: plausible, useful-looking results arriving under a trusted completed-task ID.

Expected

A background agent that reports completed should not resume execution, and a task ID should emit at most one completion notification (absent explicit continuation via SendMessage).

Impact

Untracked autonomous execution (token spend, side effects like spawned processes and browser actions) with no stop handle, plus notification provenance confusion in the parent session.

🤖 Generated with Claude Code