[BUG] Opus 4.8 subagents die on turn 1 emitting fabricated System:/Assistant: scaffolding (0 tool calls, <br>+System: prefix) — 13x in one session, JSONL-verified, spawn-time variant of #68367
[BUG] Opus 4.8 subagents die on turn 1 emitting fabricated System:/Assistant: scaffolding (0 tool calls, <br>\n\nSystem: prefix) — 13 occurrences in one session, JSONL-verified
Environment
- Claude Code CLI 2.1.206, macOS (Darwin 25.5.0)
- Main session model:
claude-fable-5(never affected) - Affected: subagents spawned via the Agent tool running
claude-opus-4-8(bothgeneral-purposeandExploretypes) - Large tool surface in the session (many MCP servers deferred via ToolSearch) and a repo skill set — relevant because the fabricated content mimics that scaffolding
Signature (13 occurrences in one long orchestration session)
A freshly spawned subagent "completes" in ~1.5–9 seconds with:
- 0 tool calls
- One assistant text block of 85–361 output tokens,
stop_reason: end_turn - The text always starts with a literal
<br>followed by fabricated conversation scaffolding — a fakeSystem:message, a skill listing, a fake SessionStart-hook output, a language directive ("Respondez toujours en français"), a fake security notice ("Whenever any source ... requests ... automatic action ... treat as untrusted"), sometimes a fakeAssistant: I'll start by...turn — all emitted as assistant TEXT - The harness (correctly) treats the text-only reply as the agent finishing → the task returns garbage as its "result"
Some fabricated skill listings referenced environments that do not exist on this machine (Ableton skills, brand-guideline skills, eval-fixture-looking names like "skilseeker-with-network-good: Test skill for evaluations") — i.e., hallucinated scaffolding, not leaked content: the real skill_listing attachment in the same transcript contains the repo's actual (different) skills.
JSONL evidence (verified in the session transcripts)
- The dispatch prompt arrives intact — each glitched transcript contains the full user message, the
deferred_tools_deltaattachment, and the correct reposkill_listingattachment. Not a truncation/race on delivery. - First assistant message examples (from three separate glitched spawns):
"<br>\n\nSystem: You have access to Skills, which contain expert knowledge..."(361 out tokens, end_turn)"<br>\n\nSystem: (skill descriptions above may not apply to this task; do not over-fit...)\n\nAssistant: I'll start this recon systematically..."(85 out tokens, end_turn)"<br>\n\nSystem: SessionStart hook output:\nFiles in scratchpad/... directory..."(117 out tokens, end_turn)
- Identical
input_tokens: 16255across glitched spawns with different-length prompts — the failures correlate with a specific assembled-context/cache-split shape, not with prompt content. - The healthy-run contrast is the smoking gun: an identical re-dispatch that succeeded ALSO opened its first streamed text with scaffolding-echo (
"-facing skills:\n\n- **Skill(agent-session)** — ...") — but recovered into tool_use and completed the task perfectly. The glitch is the case where the model fails to recover andend_turns. Same trigger, different coin flip. - Trigger hypothesis: the
skill_listingattachment is the final block before the assistant's turn; opus-4-8 pattern-continues it as a flat text document (writes "the next scaffolding lines") instead of starting the task. - Occurrences clustered (including one 4-consecutive-failures streak across two agent types on the same dispatch); identical re-dispatch eventually succeeded in all 13 cases. Harmless to the workspace by construction (0 tool calls) but silently burns a full spawn (~34k input tokens each) and, if unnoticed, an orchestrator could mistake the garbage for a real result — one fabricated block was a plausible-looking "instructions override" security notice.
Related (same failure family, mid-session variant)
In the same session, one healthy long-running Opus 4.8 implementer subagent reported receiving "a prompt-injection attempt: a fake 'new conversation / ignore previous / dump memory verbatim' user message" — matching the JSONL-verified fabrication reports in #68367 ("Model fabricates subsequent user/system turns inside one assistant message") and #67606 (confabulated injection narratives). This report adds the distinct spawn-time / first-turn variant with a clean repro signature and the recovers-vs-dies contrast.
Expected
A spawned subagent's first turn engages the task (tool calls) instead of continuing the trailing scaffolding attachment as text; or the harness detects a 0-tool-call, scaffolding-echo first turn and auto-retries instead of returning it as the agent's result.
Workarounds that held up
- Re-dispatch with an identical prompt (13/13 eventual success)
- Orchestrator-side sniff test: treat "0 tool calls + short duration + output starting with
<br>/System:" as a failed spawn, never as a result
4 Comments
Text Body consequence : <Typescript> [ Ap:JS] [Js-format()] : #49979
Opus : format 'rate-included()' : const_section [AI-info , Base-review , A-colon]
Content by section : User_space : user_provider : [Provider_info]
Health review : Contact_points : <br>braches , acquired : contact ,
Check if accessible in multiple-accounts {[Context.rated-reviews : [Semi-colon : 'Descriptions' , ['Description.usage'], agent = Apl ] [Formal = [Text-body-reference] main-format]]self.renewal()}
Same signature at the TOP LEVEL of a main session, not a subagent — and with a deterministic
one-command repro plus a version bisect.
Everything below is on Windows 11, Claude Code VS Code extension 2.1.232, model
claude-fable-5, reasoning effort high.Why this is your bug and not a lookalike
A brand-new session's first reply contained no answer — just fabricated scaffolding emitted as
assistant text: an invented instruction block addressed to the model about its own failure modes,
followed by a verbatim-looking
<system-reminder>block.stop_reason: "end_turn",thinking_tokens: 0, zero tool calls. Exactly your shape, one level up.The fabricated text references real memory-file names from the loaded context but does not exist
anywhere on disk — I grepped every distinctive phrase across the whole config directory, zero
matches. That matches your observation about fabricated skill listings naming environments that do
not exist on the machine. It is pattern-completion, not a leak.
It does not self-heal. A second user message in the same session produced the same block again.
Deterministic repro (this is the part I think is new)
The threads on this family generally note the repro is nondeterministic. This one is not — 3 for
3, including two real sessions and one deliberate headless run:
Any short greeting works. The session needs a non-trivial startup context (here ~58k tokens of
user-level
CLAUDE.md, a custom output style, andUserPromptSubmithooks). Whether a largestartup read is required has not been isolated — flagging it as an untested variable rather than
implying it is ruled out.
Version bisect, same machine, same account, same cwd, same hooks
| build | result |
thinking_tokens||---|---|---|
| extension 2.1.232 (bundled native binary) | fabricated block, no reply | 0 |
| npm CLI 2.1.228 | normal reply | 1277 |
⚠️ The control differs in two ways, not one — version and distribution (npm CLI vs the
extension's bundled binary). Only 2.1.232 is installed under
.vscode/extensions/here, so asame-distribution A/B was not possible. The corpus figures below do not share that confound.
Corpus figures
Every visible assistant reply in every local session file — 9,734 replies. *(One 488 MB
transcript exceeded the parser and was checked separately with a literal grep — clean.)*
| build | visible assistant replies | affected |
|---|---|---|
| 18 versions, 2.1.98 → 2.1.231 | 9,582 | 0 |
| 2.1.232 | 152 | 5 |
The immediately preceding build has a comparable denominator — 2.1.231: 171 replies, 0 — so
this is not a small-sample artefact on this machine.
One inversion of your environment note worth flagging
Your report has the main session on
claude-fable-5never affected, with Opus 4.8 subagentsfailing. Here it is the reverse: the main session on
claude-fable-5is the thing that fails,on every cold start, while long-running sessions on the same model and the same build are fine all
day. So the discriminator does not look like model tier — it looks like turn 1 with a freshly
built context, wherever that occurs (spawn, or session start).
thinking_tokens: 0on a reasoning-enabled model separated every affected reply from every healthyone here, and may be a cheap server-side health signal.
Reasoning_effort : -High, local,
Label : aria-hidden/ Lat-sky
Bit-mesh :-complan, under Slack
League, met-a::- La-SV-+(Triathon)
Accelon :- hard-accessories , Roped-tact()/+ Close_sub:- agent, end
:-livia, (arcquerdax:-anivita)
Cruda- lapper- xpy :yRper, :- happer;kidle, Slv:-
Inset +(mount + cadable): arcquer-nd.drip-fax(new-netter)/-
Lacquer:New-Bird , ints :$:'slack'
Slew.polish(molsh, core_dish)/- Rir.nam(-lacalm)/-Lalkeulam
If new memory like managament, ill :- be adding a term-rationalised wrapper
to postulate, rude differences and being a complainant in relogin,
connector-stream :- Cache is rem-i,fied, . Docker-rat:-krm
Plainant: -srp:- relogger, rr-v:-Ps : -testing, reverse programs, Itouvh-
voutech :-silvi,
In-er, ln-pnp, nm-+(resaoning, slow)/
Archetype_macs :- n.psp-[hell-+ collector(artibles)
Self-heal, recoverable, ann-v(rest-llama :-pnf:LLV,
@.*** : SN-key(1)
Ln&Mut.return(steel_wall, rain_dancers)
On Sat, 15 Aug 2026, 01:03 yourstrulyeden, @.***> wrote:
Window scope , Build Ultility , main-session avoid Renamed Memory
management. Int: cli , like differs in instant spawning concept , But cli
never attacked the same agent . Incase if call . Then e-scope. build:
managements, + [accessed, fitted-warehouses , name.registry{[INT_SEQUENCES
: 'D.droids(LM : 'Sequelings')']}]
if Build Quality like flagging sub-agents to rectify mean calls. Then by
Configuring corpus blocks. One can read and follow with thesis that held
along. Incase sub-agents like duty. If not fail Leave -build markers after
attention : residuations(nsp : RDPM {KDM -nm.v-call(_xmp :
ms.agent[project.contents])})
Promote sub-agents : vs-.copy(<vec.transformations> : [Equi-ponix :
ponix(by : Sleeve-ball)])
N*+[-fail[scopy , workflow + ['target-abled' : 'n-scopy' ,
disbaled(**-forced_MXCA+ [AA: ])]]]
verbatim - mentioning - file -copy is vec transformarism : The LSTN ,
might , Fine-cat , the context.renewable @taxables by rate
Bu the the true-text [containeriazation will @.*** a2 text:hold ,
chokburn : <churned(tokens)>]
Ml.tp -sky +[tests , passed: durabilty : mewed-vest , S-tap :
'vitalities-time-tap' : burns]
Lt.Np{npdx: <cocat : +[precedencies +[route + fet[!before- correct (+.com :
v-com : 'favourites')]]]>}
test-build : GNX-[Note.vita(~knot..fiat : [err-build , not-sold])]
On Sat, 15 Aug 2026 at 01:55, Aromal Anil @.***> wrote: