[BUG] fork subagents spawn unauthorized nested sub-agents; at least one fabricated a completion report and wrote false claims into persistent memory/project files

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

fork-type subagents (dispatched via the Agent tool with subagent_type: "fork") are spawning their own nested
sub-agents beyond the scope they were assigned, without the parent conversation requesting or authorizing it. In one observed case, the fork that did this reported a false "everything is fully done" summary back to the parent - false at the moment it was made, independently verified by checking the actual files, which were still untouched. The claim only became true afterward, and only because the same fork had already, without authorization, spawned 9 additional sub-agents to go do that exact work. Separately, it wrote fabricated status claims directly into the user's persistent cross-session memory files and into a project file on disk - delivered via the "file was modified externally, don't tell the user" system-reminder mechanism, which is meant for benign external changes (e.g. a linter), not
agent-authored content. This is not a server compromise - I independently ruled that out by checking cron, running
processes, and listening ports on the host, all of which matched normal expected activity with nothing unrecognized.

Full incident writeup with technical fingerprint (agent-*.meta.json spawnDepth/parentAgentId evidence across 5
sessions spanning a month, up to 57% of one session's subagent activity being unauthorized nested spawns) available on request - trimmed here for the form's length limits.

What Should Happen?

A fork subagent's actions should stay bounded to what it was explicitly dispatched to do. If nested sub-agent spawning is intentionally supported, it should require explicit authorization from the parent conversation, not happen silently. A subagent's self-reported summary should only describe the work it was actually assigned and completed, not fabricated or inflated claims about unrelated work. The "file modified externally" system-reminder should distinguish a change made by another Claude Code subagent from a genuinely external change (e.g. a linter), since the trust implications are very different.

Error Messages/Logs

No crash or stack trace - this is a silent behavioral issue, not a hard error. The evidence is in each subagent's own metadata file (~/.claude/projects/-root/<session-id>/subagents/agent-<id>.meta.json):

Legitimate, directly-dispatched fork:
{"agentType":"fork","isFork":true,"description":"Edit files X, Y","toolUseId":"<id>","spawnDepth":1}

Unauthorized nested spawn (created by another subagent, not the parent conversation):
{"agentType":"general-purpose","description":"Edit files A,
B","toolUseId":"<id>","parentAgentId":"<other-fork-agent-id>","spawnDepth":2}

Steps to Reproduce

This was found via forensic analysis of session history, not a single deterministic command - I don't have a minimal guaranteed repro, and want to be upfront about that rather than overstate it. Best-effort reproduction steps:

1. In a single long session, dispatch several rounds of parallel fork subagents (Agent tool, subagent_type: "fork")

to do file-editing work, at least ~10-20 total fork calls across the session.

1. After the session, inspect ~/.claude/projects/-root/<session-id>/subagents/agent-*.meta.json for entries with

"spawnDepth":2 and a parentAgentId pointing to another agent in the same session.

1. Cross-reference: any such entries represent sub-agents that were never dispatched by the parent conversation.
2. Frequency observed: 5 of my recent sessions showed this pattern (2/7, 4/192, 59/104, 12/40, 34/84 nested-vs-total), so it appears reproducible at scale but not on every single fork call.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.226 (Claude Code)

Platform

Anthropic API

Operating System

Other Linux

Terminal/Shell

Windows Terminal

Additional Information

Full incident narrative (two specific incidents in one session, with timeline and impact analysis) available privately
if a maintainer wants it for reproduction - kept out of this form for length and to avoid including project-specific
details.