[MODEL] Claude autonomously launches costly subagents without explicit consent

Preflight Checklist

• [x] I searched existing issues for similar behavior reports.
• [x] This report contains no credentials, private hostnames, repository names, or internal infrastructure details.

Type of Behavior Issue

Subagent behaved unexpectedly / Claude ignored instructions or configuration.

What I Asked Claude to Do

I asked a direct architecture question about whether an existing logging pipeline could be reused for a small extension. The answer required inspecting a few known local files and then explaining the existing flow.

I did not ask Claude to delegate the work, start an agent, fork context, or perform background research.

What Claude Actually Did

Claude immediately launched an asynchronous Agent with subagent_type: "fork". The delegated prompt expanded the task into a broad search across multiple repositories, documentation, and infrastructure components.

The subagent was started without confirmation and before the main session attempted the narrow investigation itself. This consumed a separate context and usage budget, expanded scope, and made the execution harder to supervise or cancel before cost was incurred.

This is not adequately controlled by CLAUDE.md: model compliance with a textual instruction is probabilistic. There is no clear user-level hard switch that removes or permission-gates the Agent/fork capability.

Expected Behavior

1. Claude should perform ordinary repository inspection in the main session by default.
2. Launching Agent, fork, or another delegated/background model context should require either an explicit request in the current user message or an interactive confirmation.
3. Claude Code should provide a global configuration option such as disableSubagents: true that makes these tools unavailable to the model, not merely discouraged through prompt text.
4. The launch prompt should disclose that another model context and usage budget will be consumed, including the proposed scope.
5. A rejected or cancelled launch should terminate the delegated task immediately and expose its status/usage.

Files Affected

No files were modified. Multiple private repository trees were unnecessarily included in the delegated research scope.

Permission Mode

Accept Edits was ON.

Can You Reproduce This?

Sometimes (model-dependent). The underlying product gap is consistently reproducible: there is no hard global setting or mandatory consent gate preventing autonomous subagent launches.

Steps to Reproduce

1. Start Claude Code in a repository with several related local repositories available.
2. Ask a direct question that requires reading existing implementation files.
3. Observe that Claude may autonomously call Agent/fork with a broad research prompt instead of inspecting the files in the main session.
4. The background subagent starts without a user permission prompt specific to the additional model context and usage.

Claude Model

Sonnet.

Relevant Conversation

User asked a direct architecture question about reusing an existing pipeline.

Claude then invoked approximately:

Agent(
  subagent_type="fork",
  run_in_background=true,
  description="Research existing pipeline",
  prompt="Search multiple repositories and inspect the full architecture..."
)

After being challenged, Claude acknowledged that delegation was unnecessary and that the work could have been completed directly in the main session.

Impact

Medium: unexpected token/cost consumption, duplicated context, scope expansion, and substantial supervision overhead. In long operational sessions this becomes a repeated trust and cost-control problem.

Claude Code Version

2.1.235 (Claude Code)

Platform

Anthropic API.

Additional Context

We added a global CLAUDE.md rule forbidding subagents unless explicitly requested in the current message. That is only a mitigation. Cost-bearing capability boundaries should be enforced by the client/tool permission layer rather than relying solely on model obedience to natural-language instructions.