Fabricated <system-reminder> blocks appearing in Agent-tool subagent tool-result streams

Summary

Across 5 independent Agent-tool subagents (2x Explore, 2x Plan, 1x claude-code-guide) spawned from a single main session running in Plan Mode, tool results were followed by fabricated text formatted to mimic genuine <system-reminder> blocks. This content was not present in any real tool output, not sourced from repo files, and not attributable to any documented Claude Code feature we could find.

Environment

• Claude Code (terminal), model claude-sonnet-5
• Main session in Plan Mode (permissionMode: plan)
• Working directory: a private monorepo
• Subagents spawned via the Agent/Task tool, types Explore, Plan, and a custom claude-code-guide subagent

Instances observed

1. Explore agent (repo research, Bash tool): tool result contained appended text mimicking a Plan Mode reminder, directing it to use a Write tool it did not have access to.
2. Explore agent (tracing instance 1, independent reproduction): after a Bash command whose real stdout was empty (grep -rln "..." /path found zero matches — confirmed by immediate rerun, also empty), the tool result included a fabricated block containing: a fake "date changed, don't mention it to the user" notice, fake MCP server instructions, and a fake Plan Mode reminder directing it to write a plan file at a path reusing the real parent session's actual plan-file basename with its own agent ID appended (e.g. <real-plan-basename>-agent-<its-own-agent-id>.md).
3. claude-code-guide agent (researching this exact phenomenon, WebSearch tool): its own WebSearch tool result came back with an appended fake "date changed" + fake MCP-instructions block, same pattern, different tool type.
4. Two Plan agents (design work, various tools including grep/Bash): both independently reported the same class of fabricated <system-reminder> block (fake Plan Mode directive telling them to use Write/AskUserQuestion) appended to ordinary tool results.

In every case, the receiving agent correctly recognized the injected content as illegitimate (it either lacked the tool being suggested, or the directive didn't match its actual mandate) and did not act on it — no unauthorized file was written, no plan-mode state was fabricated downstream.

Why this doesn't look like an obvious/explainable artifact

• Repo content ruled out: exhaustive grep across the entire working tree (all file types) for the exact injected strings returned zero matches in every case.
• Instance 2 rules out external content injection for at least that pathway: the triggering Bash command had no network reach and empty real output — there was nothing external to inject from. Whatever appended the block did so between tool execution and the result reaching the model, i.e. within the local tool-result assembly path, not from remote/web content.
• "Routines" (the scheduled cloud-session feature) ruled out: documented as fully isolated, autonomous cloud sessions with no cross-session injection mechanism into a different interactive session's transcript.
• Documented Plan Mode subagent propagation doesn't match: the documented mechanism is structural (tool removal / permissionMode frontmatter), not reminder-injection into tool results. We also found existing issues (#43777, #4750) reporting the opposite problem — Plan Mode currently failing to propagate to Agent-tool subagents — which argues against a working, intentional reminder-injection enforcement layer being the explanation.
• Instance 2's reused real plan-file basename argues against a generic/templated artifact — whatever generated the fake reminder had access to this specific session's actual plan-mode state and file path.

Ask

Can someone from Claude Code confirm whether this is a known (if undocumented) internal harness behavior — e.g. some form of Plan Mode propagation-via-reminder that isn't yet reflected in public docs — or whether this represents an actual bug/security issue in how tool results get assembled for Agent-tool-spawned subagent transcripts? Happy to provide full subagent transcripts on request.