[CRITICAL] Recursive subagent fan-out survives Stop and hard-freezes Windows at 100% CPU

Summary

Claude Code's recursive subagent capability can create a very wide descendant tree even though nesting is capped at five levels. In three incidents, a small number of top-level Agent calls expanded into approximately 380–583 Agent records, saturated a 16-core / 32-thread CPU at 100%, made Windows completely unresponsive, and forced a hardware restart.

The most recent incident also shows a cancellation failure: after I issued Stop and Claude Code recorded rejected parent Agent calls, approximately 300 additional Agent metadata records were created and 256 further nested Agent tool calls occurred. The final new Agent was created less than one minute before the forced reboot.

This is not only a token-cost or model-behavior issue. It is a host-stability and orchestration-safety issue:

• recursive depth is capped, but breadth and total descendant count are not effectively bounded;
• there is no visible CPU- or memory-aware launch backpressure;
• Stop does not atomically prevent all existing descendants and queued descendants from continuing to spawn;
• the root session does not appear to have a reliable emergency kill path for the complete descendant tree;
• pathological fan-out can make the operating system unusable before the user can recover control.

Existing issues document individual parts of this failure mode, including recursive fan-out, host OOM, runaway costs, unreachable descendants, and failed cancellation. This report adds repeated Windows whole-machine hard freezes, direct CPU-saturation observation, detailed spawn-depth/tool-call measurements, and post-Stop descendant creation.

Environment

• Claude Code versions observed:
• 2.1.196 — earlier non-fatal recursive expansion
• 2.1.207 — two Windows hard-freeze incidents
• 2.1.208 — latest Windows hard-freeze incident
• OS: Windows 11 Pro
• OS version: 10.0.26200, build 26200
• CPU: AMD Ryzen 9 8945HX
• CPU topology: 16 physical cores / 32 logical processors
• RAM: approximately 31.22 GiB
• Pagefile allocation: approximately 31.22 GiB
• Node.js: v22.16.0
• Interface: Claude Code CLI
• Timezone for every timestamp below: Asia/Taipei, UTC+08:00
• Model path in the three local hard-freeze incidents: third-party models through a Claude Code-compatible endpoint
• Related existing issues demonstrate the same recursive fan-out with native Claude Opus models, so a third-party model is not required for the underlying scheduler failure.

Relevant Claude Code behavior change

Claude Code v2.1.172 added the following capability:

Sub-agents can now spawn their own sub-agents (up to 5 levels deep)

Source:

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

The five-level depth cap is not sufficient to bound the size of the tree. If every Agent creates five children, the theoretical width grows as follows:

Depth 1:    5
Depth 2:   25
Depth 3:  125
Depth 4:  625
Depth 5: 3125

The observed failures remained within the five-level cap. The unsafe behavior came from breadth and total descendant count, not from bypassing the depth cap.

Incident timeline

All times below are Asia/Taipei, UTC+08:00.

Incident 1 — 2026-07-13 morning

• Claude Code version: 2.1.207
• The parent session invoked a code-review operation.
• The parent explicitly issued 9 top-level background Agent calls.
• Approximately 583 Agent metadata/transcript records were associated with the incident-to-reboot window.
• Maximum observed spawn depth: 5.
• A large majority of the records were at depths 4 and 5.
• Windows recorded an unexpected shutdown at approximately 09:54:27.
• Kernel-Power Event 41 was recorded during reboot at approximately 10:14:49.
• volmgr reported crash-dump initialization/loading failure.
• No usable minidump or LiveKernelReport was produced.

Observed depth distribution for the relevant records:

| Spawn depth | Agent records |
|---:|---:|
| 2 | 40 |
| 3 | 108 |
| 4 | 199 |
| 5 | 236 |

Incident 2 — 2026-07-13 evening

• Claude Code version: 2.1.207
• The parent explicitly issued only 2 top-level background Agent calls.
• One review subagent independently invoked a high-effort code-review skill.
• Approximately 383 Agent metadata/transcript records were associated with the incident window.
• Maximum observed spawn depth: 5.
• Windows recorded an unexpected shutdown at approximately 20:52:47.
• Kernel-Power Event 41 was recorded during reboot at approximately 20:59:21.
• No usable crash dump was produced.

Observed depth distribution:

| Spawn depth | Agent records |
|---:|---:|
| 1 | 2 |
| 2 | 10 |
| 3 | 74 |
| 4 | 162 |
| 5 | 135 |

This incident is important because the parent did not explicitly request a large fan-out. Two parent Agent calls were enough to produce hundreds of descendants after a review subagent delegated recursively.

Incident 3 — 2026-07-14 afternoon

• Claude Code version: 2.1.208
• At approximately 15:13:33, a high-effort code-review operation explicitly launched 8 top-level general-purpose review agents.
• The tree produced 380 Agent metadata/transcript records.
• Maximum observed spawn depth: 5.
• CPU usage was directly observed at 100% before Windows became completely unresponsive.
• The system required a forced restart.
• Kernel-Power Event 41 was recorded at 15:25:21.
• EventLog Event 6008 recorded an unexpected previous shutdown.
• volmgr reported crash-dump initialization failure.
• No usable minidump or LiveKernelReport was produced.

Observed depth distribution:

| Spawn depth | Agent records |
|---:|---:|
| 1 | 8 |
| 2 | 42 |
| 3 | 94 |
| 4 | 159 |
| 5 | 77 |

Sequential parsing of the 380 subagent transcripts found:

• 3,522 unique tool-use IDs;
• 398 nested Agent tool calls inside subagent transcripts;
• 229 code-review skill invocations inside subagent transcripts;
• 74 subagent transcripts that themselves issued one or more Agent calls;
• up to 11 nested Agent calls from a single subagent transcript.

Tool-use distribution in those subagent transcripts:

| Tool | Calls |
|---|---:|
| Read | 1,063 |
| Bash | 963 |
| Glob | 404 |
| Agent | 398 |
| Grep | 361 |
| Skill | 229 |
| Other tools | 104 |
| Total | 3,522 |

Stop did not cancel the complete descendant tree

During Incident 3:

• At approximately 15:17:28, I sent Stop.
• At approximately 15:17:35, Claude Code recorded user-rejected/denied parent Agent tool calls.
• Despite that cancellation state, approximately 300 additional Agent metadata records were created afterward.
• 256 nested Agent tool calls occurred after the Stop/denial timestamp.
• The final new Agent metadata record was created at 15:24:44.958.
• Kernel-Power Event 41 was recorded at 15:25:21, approximately 36 seconds later.

The post-Stop records were concentrated at deeper levels:

| Spawn depth | Agent records created after Stop |
|---:|---:|
| 2 | 2 |
| 3 | 64 |
| 4 | 157 |
| 5 | 77 |
| Total | 300 |

This suggests that Stop rejected some root-level tool calls but did not atomically invalidate the entire descendant tree or all queued/future child spawns.

Earlier non-fatal evidence

The recursive behavior predates the three hard freezes.

On 2026-07-01:

• Claude Code version: 2.1.196
• The parent issued one code-reviewer Agent call.
• Seven seconds later, that subagent independently invoked another code-review skill.
• The operation expanded to 82 Agent records.
• Maximum spawn depth: 5.
• The machine did not hard-freeze, likely because the total fan-out was substantially smaller.

This indicates that the issue is not solely a 2.1.207 or 2.1.208 regression. The recursive orchestration path existed earlier, but the July 13–14 workloads expanded enough to cross the workstation's stability threshold.

Why this warrants a separate issue

Several existing issues cover overlapping symptoms, but the failure is currently fragmented across separate reports:

| Issue | Existing coverage |
|---|---|
| #68110 | Native Opus 4.6; general-purpose subagents recursively create unbounded child fan-out |
| #68619 | Recursive Agent patterns, permission interactions, lost work, and extreme token consumption |
| #72732 | Uncontrolled recursion causing very large API costs |
| #74035 | Depth-4 fan-out; Claude Code process grew to approximately 26 GB RSS and triggered host OOM |
| #77060 | Windows v2.1.202; stopped-state notification triggered a recursive task/Agent storm |
| #73829 | Nested background descendants became unreachable and unstoppable after an intermediate parent ended |
| #41461 | Windows; background agents continued after repeated Stop requests |
| #49275 | A single request reportedly created 280 parallel subagents |
| #72456 | Deep Research reportedly created 105 agents and exhausted quota |

This report is specifically about the combined host-safety invariant that is missing across those reports:

A recursively spawned Agent tree must never be able to make the user's operating system unusable, and user cancellation must prevent every descendant and queued descendant from continuing to spawn.

The new evidence not clearly captured in one existing report is:

1. Three whole-machine Windows freezes on the same workstation.
2. Directly observed 100% CPU saturation.
3. Kernel-Power Event 41 and EventLog Event 6008 after each incident.
4. Failure on a 16-core / 32-thread system with approximately 31 GiB RAM.
5. A measured 380-Agent tree with 398 nested Agent calls and 3,522 tool calls.
6. Approximately 300 new Agent records and 256 Agent calls after Stop.
7. Agent creation continuing until approximately 36 seconds before forced reboot.

The existing reports demonstrate that recursive fan-out also occurs with native Claude models and on macOS/Linux, while this report demonstrates a repeated Windows host-stability failure and tree-cancellation failure.

Expected behavior

Claude Code should enforce host-level safety independently of model behavior and task prompt:

1. A hard global limit on active descendants per root Agent call.
2. A hard global limit on total descendants per root Agent call.
3. A configurable direct-child breadth limit per Agent.
4. Recursive Agent access should be opt-in for general-purpose subagents, not inherited by default.
5. Stop should atomically cancel:

• currently running descendants;
• queued descendants;
• future Agent calls attempted by descendants;
• background tasks whose intermediate parent has already exited.

1. Once a root operation is cancelled, late child results must not be allowed to launch more descendants.
2. Local scheduling should apply CPU-, memory-, process-, and tool-call-rate backpressure.
3. The root session must be able to enumerate and force-stop every descendant.
4. A circuit breaker should pause execution and alert the user when Agent creation or tool-call velocity becomes abnormal.
5. The process should be contained by an OS-level resource boundary so an orchestration bug cannot freeze the complete workstation.

Actual behavior

• Recursion reached the documented maximum depth of 5.
• Breadth remained effectively unbounded.
• A small top-level fan-out expanded into hundreds of Agent records.
• Thousands of local tool calls were issued in minutes.
• CPU reached 100%.
• Windows became completely unresponsive.
• Stop did not prevent deeper descendants from continuing to create Agents.
• The workstation required forced restarts.
• No useful crash dump was created.

Suggested fixes

1. Global descendant budget

Track every Agent transitively owned by a root Agent call and enforce both:

• maxActiveDescendants;
• maxTotalDescendants.

The budget must apply across all nesting levels and all intermediate sessions.

2. Per-Agent breadth limit

Limit how many direct children one Agent can create. A depth limit alone does not prevent exponential fan-out.

3. Opt-in recursive delegation

Remove Agent from the default tool set of general-purpose subagents. Recursive delegation should require an explicit agent definition, workflow, or user opt-in.

4. Atomic tree cancellation

A Stop request should mark the root tree cancelled in a shared registry. Every Agent launch should check that registry immediately before launch. Descendants must not be able to create new Agents once any ancestor has been cancelled.

5. Root-owned descendant registry

All descendants should remain visible and stoppable from the root session, even after an intermediate parent finishes or crashes.

6. Resource-aware backpressure

Before launching more local Agent/tool work, monitor:

• process CPU usage;
• system CPU usage;
• RSS / committed memory;
• process and thread count;
• recent Agent creation rate;
• recent tool-call rate.

Pause and request confirmation when thresholds are exceeded.

7. Emergency kill-tree command

Provide a user-visible action that terminates all Agent descendants and queued Agent work for the current session without relying on the model to cooperate.

8. OS-level containment

On Windows, place Agent/tool worker processes in a Job Object with CPU, process-count, memory, and kill-on-parent-exit controls. Equivalent cgroup/process-group containment should be used on Linux and macOS.

Reproduction warning

I do not recommend reproducing this on an unrestricted workstation.

A safe test should run inside a VM or an OS-level resource container and automatically terminate when any of these thresholds is reached:

• more than 16 active descendants;
• more than 64 total descendants;
• spawn depth greater than 2;
• sustained high CPU usage;
• any new Agent created after cancellation.

A minimal test shape would be:

1. Use a Claude Code version at or after 2.1.172.
2. Start a broad review/research task through one or more general-purpose Agents.
3. Allow subagents to retain access to the Agent tool.
4. Observe whether descendants recursively delegate.
5. Issue Stop after the first nested fan-out.
6. Verify whether any descendant Agent calls or Agent metadata records are created afterward.

Windows event evidence

Each hard-freeze incident was followed by:

• Microsoft-Windows-Kernel-Power, Event ID 41;
• EventLog, Event ID 6008;
• volmgr Events 45/46 indicating crash-dump initialization/loading failure.

No usable minidump or LiveKernelReport was produced.

Resource-Exhaustion-Detector Event 2004 records existed at unrelated times but did not align with the three incidents. The directly observed resource symptom during the incidents was CPU saturation.

nvlddmkm Event 14 appeared after reboot, but there was no matching display-driver-reset Event 4101 or usable kernel dump. The current evidence does not establish the NVIDIA driver as the primary trigger.

Evidence available

The following sanitized evidence is available on request:

• parent Agent and Skill tool-call excerpts;
• sanitized subagent metadata containing only agent type, generic description, tool-use ID hash, and spawn depth;
• per-minute Agent creation counts;
• tool-call counts before and after Stop;
• Windows Event Viewer exports for Events 41, 6008, 45/46, 14, and 2004;
• a compact script that counts Agent records and spawn-depth distribution without exposing transcript contents.

Additional notes

• This report does not claim that all 380–583 Agent records were simultaneously active. The counts refer to Agent metadata/transcript records associated with each incident window.
• The CPU observation was made directly before the machine became unresponsive.
• File creation/modification timestamps and Claude Code transcript timestamps were correlated using Asia/Taipei time, UTC+08:00.