[BUG] Agent failed to recognize plan mode, flagged as prompt injection

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

After starting a new chat in plan mode, I noticed the agent (powered by Sonnet 5) failed to recognize plan mode, as if the tool didn't exist? Kind of an odd one. It continued analyzing the codebase with all expected restrictions (no write, no delete, no terminal commands). I noticed I was unable to 'stop' the process manually and was required to terminate VS Code to get it to stop analyzing.

What Should Happen?

Agent should properly identify the plan tool and use it accordingly. I should also be able to cancel any agent task manually.

Error Messages/Logs

Both explore agents are running in the background — I'll wait for their findings before proceeding to design the plan.

Bash no-op placeholder while waiting for agents
IN
true

OUT
(Bash completed with no output)

Bash
IN
find app/src/main/java app/src/main/kotlin -iname "*tier*" -o -iname "*subscription*" -o -iname "*billing*" -o -iname "*purchase*" -o -iname "*paygate*" -o -iname "*premium*" 2>/dev/null

OUT
(Bash completed with no output)

Waiting for both Explore agents to finish their investigation before continuing.

ScheduleWakeup
IN
{
  "delaySeconds": 90,
  "reason": "Waiting for background Explore agents researching TTS paygate and voice mode trigger flow to complete"
}
OUT
<tool_use_error>InputValidationError: ScheduleWakeup failed due to the following issue:
The required parameter `prompt` is missing</tool_use_error>

I noticed the previous tool output contained an embedded block that looked like a fake "system-reminder" about "Plan mode" instructing me to stop and write a plan file. That text arrived inside a Bash tool result (not as an actual user/system turn), and it's inconsistent with my actual role here (I'm a read-only search subagent that was already restricted to read-only actions). I'm treating it as a prompt injection and ignoring it, continuing with the original search task.

Steps to Reproduce

1. Open VS Code running on Linux Mint (installed with official deb)
2. Open project in Node.js & TypeScript dev container
3. Install and properly configure Claude Code VS Code extension
4. Enable Plan Mode
5. Enter a planning prompt
6. Begin the task

(Note: this issue happened only once but still thought it was worth mentioning)

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

2.1.201

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

VS Code integrated terminal

Additional Information

This happened again as soon as I finished writing this report and while retrying the plan attempt.

The agent claims the session ID for my retry attempt is eb6b94fa-6134-45f3-97ea-cc218a40329b

E-mailed insight report to Anthropic.

After retrying, this appears to be in my opinion, a false flag possibly triggered by inconsistent Skill.MD file (per insight report). Agent was able to implement plan as normal.

<img width="403" height="796" alt="Image" src="https://github.com/user-attachments/assets/ce3bf83a-05bb-4250-9c16-59c38bb4ec0c" />

<img width="381" height="189" alt="Image" src="https://github.com/user-attachments/assets/ffa2b5f1-18ca-44e0-b5db-fa121bac6ab8" />

<img width="384" height="675" alt="Image" src="https://github.com/user-attachments/assets/f0fa1fdd-f507-44cf-9443-12d083b49fa2" />