Nested code-review fan-out spawned 877 agents despite 5-level depth limit

Summary

A normal /code-review run recursively spawned hundreds of descendant agents because angle-specific review agents re-entered the full code-review workflow. Claude Code enforced the 5-level nesting limit, but there was no effective limit on the total number of descendants, concurrency, or token budget.

The initial fan-out of 5–8 review agents is reasonable. The problem is that each child can repeat the parent orchestration, turning a simple review into hundreds of agents without confirmation.

Environment

• Claude Code: 2.1.208
• Platform: macOS (Darwin 24.5.0)
• Session ID: 89cd7c22-ee41-4bff-ab03-c663a8aceea9
• Command/workflow: /code-review on the current branch relative to a base branch

What happened

The top-level review launched 8 specialized finder agents. Those agents were each assigned a single review angle, but they invoked the complete code-review skill again. The complete workflow then launched more finder agents, whose children repeated the same behavior.

Observed descendant distribution from the session's subagent metadata:

| Spawn depth | Agent count |
|---:|---:|
| 1 | 8 |
| 2 | 42 |
| 3 | 141 |
| 4 | 416 |
| 5 | 270 |
| Total | 877 |

The tree stopped at depth 5, which is consistent with the documented nested-subagent depth limit, but the breadth still produced an unreasonable number of model calls.

Other session-level observations:

• Agent calls: 877
• Skill calls: approximately 600
• Repeated reads of the same diff and repository context across descendants
• Aggregated transcript usage fields were approximately 30M input tokens and 2.6M output tokens, plus approximately 44M cache-read input tokens. These are transcript usage aggregates, not a claim about the final billed amount.

The original code change was modest (roughly 12 committed files and 5 working-tree files), so this scale was not justified by the task.

Expected behavior

A /code-review invocation that starts 5–8 specialized reviewers should remain bounded to approximately that number plus a small, deliberate verification stage.

An angle-specific child reviewer should not restart the entire parent review workflow. More generally, a single top-level task should not be able to create hundreds of descendants without an explicit user decision.

Actual behavior

/code-review
  -> 8 angle-specific agents
       -> each can invoke the full /code-review workflow again
            -> more angle-specific agents
                 -> repeated until the 5-level depth limit

The existing depth limit prevents infinite depth, but it does not prevent exponential breadth.

Reproduction notes

The behavior may depend on model decisions, so it may not reproduce deterministically:

1. Run /code-review with a review mode that fans out to multiple specialized agents.
2. The parent assigns each child a single angle.
3. Observe whether a child invokes the complete code-review skill instead of directly performing its assigned angle.
4. If it does, inspect the agent panel or session transcript; descendant counts grow rapidly until the nesting-depth limit is reached.

In the affected session, the runtime code-review skill text described an 8-angle high-effort workflow. It did not match the currently cached marketplace plugin command exactly, so this may involve the runtime/built-in review engine rather than only the public plugin prompt.

Suggested safeguards

Please consider runtime-enforced limits in addition to prompt-level guidance:

1. A maximum total descendant-agent count per top-level turn/task.
2. A maximum concurrent-agent count and inherited token/cost budget.
3. Confirmation before crossing a threshold such as 16 or 32 descendants.
4. A non-reentrant marker for orchestration skills such as code-review.
5. Child agents created for leaf work should not receive the Agent tool unless the parent explicitly opts in.
6. Budgets should be inherited and reduced through nested calls rather than reset for each child.

Prompting child agents not to delegate is useful, but it is not a sufficient safety boundary when the consequence can be hundreds of model calls.

Related reports

• https://github.com/anthropics/claude-code/issues/4850 — earlier recursive subagent loop, reported fixed in 1.0.64
• https://github.com/anthropics/claude-plugins-official/issues/383 — plugin fan-out overriding user subagent limits

The current case differs from #4850 because nesting is intentionally supported up to five levels now; the missing guard is on total breadth/budget rather than depth alone.