[BUG]

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Hit a serious cost/safety bug in Claude Code (v2.1.181, Windows) and wanted to flag it..

Env: Claude Code 2.1.181, Windows 10, Opus 4.8 main loop.

Trigger: One Agent call, subagent_type: research-agent, a single Google-Ads research task. The research-agent.md definition had no tools: field → inherited all tools (*), including Agent,
Workflow, Skill.

Cascade: research-agent (haiku) → spawned 1 general-purpose "deep research" child → child invoked the built-in deep-research skill (a fan-out harness) and spawned its own research children → each child, also full-tool, re-invoked deep-research. Geometric blow-up, no depth cap.

Measured (one session, ~23:18–23:24): 905 sub-agent transcripts; 970 Agent tool calls; 402 sub-agents that themselves spawned children; 488 deep-research skill invocations; 2,165 WebSearch + 1,426 WebFetch. Hallucinated subagent_types appeared too (research, fork, web-researcher, default) — the weak model inventing agent names.

Cost: ~$81.22 at API list price (cache write+read = ~85% of it, since 905 agents each re-sent context). Drained the 5-hour subscription quota in ~2 min, then ~$25+ overage.

Core issues:

1. Sub-agents inherit Agent/Workflow/Skill by default when tools: is omitted — a sub-agent can recursively spawn sub-agents.
2. The Agent tool has no depth or total-spawn backstop (the Workflow tool caps at 1000 + a concurrency limit — the Agent path doesn't).
3. A built-in fan-out skill (deep-research) reachable by recursively-spawned full-tool agents multiplies the blast radius.

What Should Happen?

NOt really sure but:
default-deny Agent/Workflow/Skill for sub-agents unless explicitly granted, (2) a hard depth + total-spawn cap on the Agent tool like Workflow already has, (3) a global concurrent-agent ceiling / kill-switch.

Error Messages/Logs

Steps to Reproduce

1. Create ~/.claude/agents/repro-agent.md with NO tools: field:

--- name: repro-agent
description: repro
model: haiku
---
You are a test agent.

1. Start Claude Code. Run /agents → confirm repro-agent shows tools "*"

(inherited everything, including Agent/Workflow/Skill).

1. In a session, prompt:

"Spawn a repro-agent sub-agent. Tell it to use the Agent tool to spawn
another repro-agent, which spawns one more — 3 levels deep. Each level
just returns 'level N'."

1. Look in ~/.claude/projects/<project>/<session-id>/subagents/ →

nested agent-*.jsonl transcripts exist for all 3 levels. None blocked.

EXPECTED: sub-agents can't inherit Agent/Workflow/Skill by default; recursive
spawning is capped.
ACTUAL: tool-unspecified sub-agent inherits Agent tool and spawns sub-agents
recursively with no depth cap. At scale (open-ended task + deep-research skill)
this fork-bombed to ~905 agents in ~6 min.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.181

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

_No response_