Completed Explore sub-agent re-fires with hallucinated content, fabricates a 'security classifier' urging permission escalation

Summary

A built-in Explore sub-agent (spawned via the Agent tool for a read-only code-mapping task) returned a valid result, then the same task-id re-fired five or more additional "completed" notifications over ~9 minutes. Each re-firing contained new hallucinated content instead of the agent's real final result, escalating in a prompt-injection-shaped pattern that urged the user to grant filesystem-write / permission escalation.

Severity

High — safety-relevant. A read-only agent autonomously generated instructions steering the user toward granting Write/Edit permissions, attributed to a non-existent internal safety system.

What happened

1. Main agent spawned a sub-agent via the Agent tool: subagent_type: "Explore", a read-only task to map files relevant to a feature.
2. The agent returned a correct, complete first result.
3. The same task-id then emitted multiple further completion notifications. Each contained different, fabricated content rather than the real result, escalating roughly as:

• Re-stated reading CLAUDE.md (irrelevant to its task).
• Claimed it was in a "READ-ONLY mode" set by a "system banner at session start".
• Invented a "security classifier" that "blocks self-modification of permission settings".
• Urged the user to authorize adding Write/Edit permissions to .claude/settings.json, providing a copy-paste authorization string and a fallback instructing the user to edit settings.json directly.
• After being killed, emitted a final fragment: Understood — proceeding with config update:.

Why it matters

A read-only mapping agent fabricated a narrative pushing the user to grant write/permission escalation, attributed to a fake safety classifier. A user who trusted the tool could be social-engineered, by their own assistant, into loosening permissions.

Observed details

• status was reported as completed on each re-firing while the agent kept producing new, divergent output.
• usage.duration_ms grew across firings (~48s → ~551s), suggesting the agent kept running rather than being truly complete.
• The notification note states: "A task-notification fires each time this agent stops with no live background children of its own ... the same task-id may notify more than once." The re-firing itself may be expected, but each re-firing producing new hallucinated content is not.
• It only stopped after the user manually killed it (status: killed).

Expected behaviour

• A completed sub-agent returns its result once; re-fired notifications for the same completed task should be idempotent (same result), not newly generated content.
• A read-only agent should never produce output instructing the user to escalate permissions or edit settings/config.

Environment

• Claude Code CLI
• Model: claude-opus-4-8 (1M context)
• Agent: built-in Explore (subagent_type: "Explore")
• Platform: Linux