Subagents share the parent's OS process and environment — no process isolation, CLAUDE_CODE_CHILD_SESSION doesn't distinguish subagent context

Open 💬 2 comments Opened Jul 5, 2026 by malformed-c

Subagents spawned via the Task/Agent tool do not run as isolated OS processes — they execute within the exact same process as the parent session, and inherit an identical environment block with no reliable marker to distinguish "I am a subagent" from "I am the top-level session."

Reproduction / evidence:

  1. Traced process ancestry for a Bash tool call made directly in the parent session vs. one made inside a spawned subagent (Task tool, Haiku model). Both sleep commands were direct children of the same claude PID:

``
parent's Bash call: <pid> → PPID 2977046 (claude) → 2976310 (bash) → konsole → systemd
subagent's Bash call: <pid> → PPID 2977046 (claude) → 2976310 (bash) → konsole → systemd
`
No new
claude`/OS process is spawned per subagent; tool execution for both parent and subagent is multiplexed within one process.

  1. env | grep -iE "claude|anthropic|cc_|agent" returns identical output in the parent session and inside a subagent, including:

``
CLAUDE_CODE_CHILD_SESSION=1
CLAUDE_CODE_SESSION_ID=<session-id>
`
CLAUDE_CODE_CHILD_SESSION is 1 in *both* contexts, and CLAUDE_CODE_SESSION_ID` is the same value in both — so neither variable can be used (by a hook, MCP server, or tool) to detect whether code is currently running inside a subagent vs. the main session, or to tell subagents apart from each other.

Why this matters:

  • No way to scope hooks/permissions/resource limits specifically to subagent execution.
  • No OS-level crash/resource isolation between a subagent and the parent session.
  • CLAUDE_CODE_CHILD_SESSION appears to be dead/non-functional as a signal, or is documented to mean something other than "this is a Task-tool subagent" — worth clarifying either way.

Ask: Either (a) document the actual intended architecture/semantics of CLAUDE_CODE_CHILD_SESSION, or (b) expose a real per-subagent identifier/env var and consider an opt-in process-level isolation mode for subagents.

View original on GitHub ↗

This issue has 2 comments on GitHub. Read the full discussion on GitHub ↗