[BUG] Unauthorised launch of extremely inefficient subagents that wasted tokens - I want a refund

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

This has happened several times now and I am getting frustrated.

I have an optimized setup - a skill that uses Grep, Graphify, Semble (in process) & a shared Serena MCP server (shared across multiple agents that I coordinate) working in the same repo.

I have a max 20x plan and there have been weeks where I would reach ~65% utilization with great difficulty.

My work pattern has not changed. If anything, My utilization should reduce because I am doing more reading and less code generation.

But every once in a while Claude code seems to go rogue (in spite of explicit instructions clearly forbidding this at a global level) and spawn up a lot of sub agents.

What Should Happen?

anthropic-incident-report-2026-06-26.md

At the very least, Claude should ask me. But I come back in a few minutes and 300-400k tokens have been wasted by then.

Error Messages/Logs

[anthropic-incident-report-2026-06-26.md](https://github.com/user-attachments/files/29354203/anthropic-incident-report-2026-06-26.md)

Steps to Reproduce

It is completely random. Most of the times the coordinator agent (I have one agent manage my all those sessions in the same repo) follows instructions precisely but every once in a while the coordinator goes and creates its own subagents and they do not use any of the tools or skills which I apply to every session and just start randomly running massive code searches.

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

• Claude Code: 2.1.191 - Model: Opus 4.8 (1M context) — claude-opus-4-8[1m] - backend/package.json version: 0.0.1

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

<img width="1915" height="1030" alt="Image" src="https://github.com/user-attachments/assets/0efb9abc-c132-4836-a8c9-40c35f914d89" />

I have many other images. But this kind of random behavior is unacceptable especially since I have suddenly started hitting usage limits before the end of the week. This has never happened before. I do not want to speculate needlessly, but it feels a little like forced token maxing.