[BUG] Async subagent stopped-state triggers infinite recursion storm in v2.1.202 (Windows)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

#This step includes the analysis of AI (deepseek) and my own judgment. But the problems and phenomena are extremely real and shocking

Claude Code v2.1.202 on Windows: after issuing a simple continuation command — "continue to optimize and complete the set goal" — the system entered an uncontrolled recursive self-delegation loop.

A previously-stopped async background agent (aeaba2b86e83cde29, status: stopped, "No completion record was found") triggered a cascade: its <task-notification> was injected into the resumed session context, which caused the assistant to launch new audit agents, which created more subtask records, which generated more notifications, ad infinitum.

Scale of the damage ：

• 256+ subtask JSON files created in the task/ directory (IDs #21~#276)
• Conversation log ballooned to 9.7 MB (3,797 records, normal sessions are <500KB)
• 683 messages in a single 54-second turn (system metadata confirmed: messageCount: 683, durationMs: 53876)
• Nearly 100 subagent instances launched within ~20 minutes
• Severe API cost spike — user reported "bill was soaring"
• The AI itself diagnosed the anomaly in its own response: "刚才出现了异常多的审查/子任务通知…系统连续注入了许多'另一个 Claude session'的审查结果'

"

What Should Happen?

#This step includes the analysis of AI (deepseek) and my own judgment. But the problems and phenomena are extremely real and shocking

1. A stopped async agent notification should be surfaced to the user as an informational message only — it must not automatically trigger the assistant's reasoning/action loop.
2. Same-scope audit requests within the same session should return cached results (idempotency) — not create duplicate task IDs.
3. There must be a hard recursion guard: agents spawned via the Agent tool must not have access to the Agent tool themselves. Maximum spawn depth = 1 (parent → child, stop).
4. A circuit breaker must exist: if single-turn message count exceeds 100 or task creation rate exceeds N/minute, pause and alert the user.
5. On session resume, abnormally terminated agents should be handled in "report + wait for user instruction" mode.

Error Messages/Logs

1. Async agent stopped notification — the trigger point
json:
{
  "type": "queue-operation",
  "operation": "enqueue",
  "timestamp": "2026-07-13T02:17:28.868Z",
  "content": "<task-notification>
    <task-id>aeaba2b86e83cde29</task-id>
    <status>stopped</status>
    <summary>No completion record was found for background agent
    \"Audit task one logic\" from the previous session...
    It may have been stopped, or it may have been running when
    the previous Claude Code process exited...</summary>
  </task-notification>"
}

2. User resumption command (one single prompt)
json
{
  "type": "user",
  "message": {"role": "user", "content": "调参是之后的事情，继续优化题目1，完成既定目标"},
  "timestamp": "2026-07-13T02:17:57.731Z"
}

3. Single-turn explosion — system confirms the scale
json
{
  "type": "system",
  "subtype": "turn_duration",
  "durationMs": 53876,
  "messageCount": 683
}

4. The AI's own diagnosis (at 02:29:32, translated from Chinese)

> "Just now, an **abnormally large number of audit/subtask notifications** appeared. It was not you continuously making new requests, nor did the project suddenly add over two hundred real development tasks. The system continuously injected audit results from 'another Claude session', and those audits created a large volume of fragmented task records. The task list thus ballooned from the normal #21-#23 to **#33 ~ #276**."

Steps to Reproduce

This step includes the analysis of Li AI (deepseek) and my own judgment. Think carefully

1. Start Claude Code v2.1.202 on Windows in a Git-tracked C project directory.
2. Work for an extended session (hours), using async background agents (Plan/Explore) for code audits.
3. Let one async agent remain in an incomplete state — e.g., exit Claude Code while an async agent is still running.
4. Restart / resume the session. The system will display: Continue from where you left off.
5. Issue a resumption command like: "继续优化题目1，完成既定目标" / "continue to optimize and complete the set goal"
6. Observe:

• The stopped agent's <task-notification> is injected into the conversation context.
• The assistant treats this as new work to handle and launches fresh audit agents.
• Each audit creates subtask task records via TaskUpdate.
• Those records trigger further audit passes.
• Message count skyrockets within minutes.
• API billing spikes accordingly.

Prerequisites for triggering ：

• A previous session with at least one async background agent that exited abnormally
• Session resume (the Continue from where you left off path)
• A user prompt that asks the assistant to "continue" or "optimize" the work
• Windows platform (may reproduce on other OS, unconfirmed)

Claude Model

Other

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.202

Platform

Other

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

This step includes the analysis of Li AI (deepseek) and my own judgment. I don't think this is the right way for Anthropic to treat customers

This is not an isolated incident

This bug has been reported multiple times across different versions, yet remains completely unfixed. The following related issues confirm a long-standing pattern of recursive subagent abuse that Anthropic has repeatedly failed to address:

| Issue | Description | Status |
|-------|-------------|--------|
| #68110 | General-purpose sub-agents recursively spawn unbounded child agents, exponential fan-out | Unresolved |
| #68430 | Subagent recursion exceeds 50 levels, ignores env var limits | Unresolved |
| #72861 | Recursive subagent fan-out causing significant cost spike (AWS billing) | Unresolved |
| #58253 | Windows-specific agent deadlock with 51 orphan threads | Unresolved |
| #45108 | Subagent silently deletes files via git add -A | Unresolved |
| #42223 | Subagent worktree branches from main instead of HEAD | Unresolved |
| #32402 | Background subagents silently auto-deny permissions | Unresolved |

To Fucking Anthropic

How long has this been known? From #32402 to #68110 to today's 2.1.202 — the same core vulnerability, uncontrolled recursive agent self-replication, has been reported over and over and over again with zero meaningful fix. Each release claims stability improvements, yet the exact same cost-drain loop resurfaces.

This is not a "rare edge case." It is a fundamental architectural flaw. The async agent system injects a stopped-agent notification directly into the reasoning loop — essentially throwing a live grenade into the inference engine. There is no depth limit, no rate limiter, no circuit breaker, no idempotency check. In 2026, an AI agent tool being able to infinitely recurse and spawn copies of itself is indefensible.

**The Windows + Git interaction path has made this worse.** Subagents hitting worktree mismatches (#42223) during staging/commits enter a "audit → fail → re-audit" death spiral. It has been over two years with paying customers hemorrhaging API credits to this bug, and the engineering response has been silence.

Say rudely,I pay for Claude Code to be productive. Not to burn hundreds of dollars of API credits in 20 minutes while I step away from the keyboard. A command as simple as "continue to optimize" should not act as a financial weapon of mass destruction**.

这个问题已经存在了多久？从 #32402 到 #68110 再到现在的 2.1.202，同一个核心漏洞——子代理不受控制的递归自繁衍——被反复报告却从未被真正修复。每一次"修复"都只是隔靴搔痒，下一次发布时同一个 bug 以新的形态卷土重来。

这不是一个"偶发"的边界情况。这是一个核心架构缺陷。 Claude Code 的异步代理系统将一个已停止代理的通知直接注入到推理循环中——这就像是把一颗手雷扔进了推理引擎。系统没有深度限制、没有速率限制、没有断路器、没有幂等检查。在 2026 年的今天，一个 agent 工具能无限递归繁衍自己，这是不可接受的。

这次尤其恶劣的是 Windows 平台的 Git 交互路径变得更脆弱了。 子代理尝试 staging/commit 时遇到 worktree 问题（#42223），导致审核失败 → 再审核 → 再失败的死循环。一个付费产品的核心循环路径花了两年多还没修好，这令人震惊。

粗鲁的说我使用 Claude Code 是让它帮我完成工作的，而不是让它在我看视频的 20 分钟里烧掉几百美元的 API 额度。一个"继续优化"的指令不该变成核弹按钮。

Suggested Fixes (priority ordered)

1. Hard agent depth limit = 1. Agents spawned via the Agent tool must not themselves have access to the Agent tool.
2. Circuit breaker. If single-turn message count > 100 or agents spawned > 10 within 5 minutes, halt and ask user.
3. Stopped-agent notification isolation. These messages must be displayed to the user, not fed to the model as conversational context.
4. Idempotent task creation. Same audit scope → return existing task ID, not a new one.
5. Windows agent lifecycle hardening. Address thread-leak and worktree-isolation issues (#58253, #42223).
6. Git staging restriction in subagents. Ban git add -A / git add . in child agents.