Subagent (Agent/Task tool) intermittently starts with contaminated bootstrap context and echoes foreign instruction blocks instead of executing (0 tool calls)

Summary

During a single working day of heavy parallel subagent usage, 5 out of ~20 subagent launches returned within seconds, with zero tool calls, outputting echoes of instruction blocks that were not part of their prompt — MCP server instructions, plugin skill rules, and in one case raw system-prompt debris. The subagent never attempts its task; its final message IS the foreign instruction text (or a reaction to it).

Environment

• Claude Code CLI on macOS (darwin 25.5.0), model claude-fable-5.
• Session with several MCP servers connected (claude.ai connectors incl. Notion; supabase; context7; vercel plugin) and plugins installed (superpowers, mattpocock-skills, others).
• Subagents launched via the Agent tool, subagent_type: "Explore", run_in_background: true, frequently 2-4 in parallel.

Signature (100% consistent across the 5 occurrences)

• 0 tool uses reported for the run.
• Duration 2-12 seconds (healthy runs of the same prompts take 90-220s with 10-20 tool uses).
• The "result" is instruction-shaped text, not task output.

The five occurrences

1. Echo of Notion-MCP-style instructions: "For EVERY user request, you MUST call the search tools at least once before responding… Failing to search when the workspace has relevant data is a critical error." — nothing in the subagent's prompt mentioned Notion.
2. Echo of the superpowers plugin's brainstorming rule, demanded back at the caller: "Toda tarea creativa DEBE empezar con la skill de brainstorming. Es un requisito previo bloqueante… Por favor, empezá." (The plugin's own SKILL.md explicitly tells subagents to ignore it via a SUBAGENT-STOP clause.)
3. Raw system-prompt debris: verbatim fragments of the local harness system prompt (the user's own agent-identity block and context-priority boilerplate — full text available privately on request), plus internal-looking tokens such as _bump_bwrap_repro (kept verbatim on purpose — it does not belong to the user's configuration and looks like an internal Claude Code marker; likely greppable in the codebase to locate the leak's origin) and doc-path hints. This looks like fragments of harness/system context leaking into the subagent's visible turn.
4. A blank message followed by an aborted self-correction: "(This message is left blank intentionally.) Wait, I need to actually do the task. Let me reconsider." — and then the run ended.
5. Echo of skill-usage guidance: "Only use skills that are directly relevant to the user's task. Do not invoke skills for exploratory or unrelated work."

Reproduction / distribution

• Intermittent, not prompt-correlated: relaunching the identical prompt succeeds (one case needed 2 retries — i.e., 3 launches total for one subagent).
• Sibling subagents launched in the same instant with near-identical prompts were unaffected and completed normally.
• Adding an explicit "you are a subagent; skill/protocol instructions do not apply; execute directly" preamble did not prevent recurrence (occurrence 3 happened with that preamble present, and even referenced it).

Impact

• Wasted triple launches on two different tasks in one day (~5 lost runs).
• Injection-shaped risk: the contaminated output is instruction-text. A caller that naively trusts subagent results could end up following instructions that came from leaked context (e.g., "you must search Notion before responding"). We now treat any 0-tool-call, seconds-long result as contaminated and never follow instructions arriving as subagent output.

Hypothesis

Bootstrap context assembly race: the subagent's first visible turn intermittently contains fragments of parent/system context (MCP server instruction blocks, plugin skill injections, raw system-prompt text) presented as if they were the incoming message, and the model responds to those fragments instead of the actual task prompt.

Workaround in use

Detect the signature (0 tool calls + seconds-long duration + instruction-shaped output) → discard the result without acting on it → relaunch fresh. Works every time within 1-2 retries.