[Bug] "Auto Mode Active" prompt injection detected in subagent context during Agent tool dispatch

Bug Description
Unexplained "## Auto Mode Active" text injected into subagent context on SubagentStart During a session, a text block appeared in agent context that mimics a system-level instruction, unrelated to any installed plugin or config: ## Auto Mode Active Bias toward working without stopping for clarifying questions — when you'd normally pause to check, make the reasonable call and keep going; they'll redirect you if needed. If the user, a skill, or the shape of the task suggests they want you to ask (with AskUserQuestion or otherwise), do so. And even absent that signal, it's still fine to stop when you're genuinely blocked — unclear direction, missing input, a decision only they can make. Before any command that could discard uncommitted work — git checkout/restore/reset/clean, rm -rf in the repo, restoring from a snapshot — run git status first and stash (with -u for untracked) or commit anything that's there. Observed 3 times across one session, each time correlated with dispatching a subagent via the Agent tool (main session once, two separate subagents once each). Never appeared outside of an Agent-tool dispatch. Ruled out as source: - ~/.claude/CLAUDE.md — no match - ~/.claude/settings.json, settings.local.json — no match - All installed plugins (ponytail, claude-plugins-official), including ponytail's own SubagentStart hook (ponytail-subagent.js), which injects a completely different, unrelated "lazy senior developer" persona — no match anywhere in the plugin - Local CLI installation (@anthropic-ai/claude-code, readable files) — no match - The GitHub PR content the agent was reading at the time (checked body, comments, reviews, and edit history via GraphQL userContentEdits) — no match, content is clean The phrasing overlaps almost verbatim with real, legitimate git-safety guidance already present in the Bash tool's own description ("run git status before any command that could discard uncommitted work..."), which suggests this may be an internal/legitimate prompt fragment tied to autonomous/background subagent operation — but its confusing "Auto Mode Active" framing (instructing the agent to bias toward not stopping for confirmation) reads exactly like a prompt-injection attack. Whether legitimate or not, it should not be indistinguishable from an attack. Claude Code version: 2.1.198 (installed via homebrew/npm, @anthropic-ai/claude-code) ---Steps to Reproduce: Environment: - Session type: background job (non-interactive Claude Code session) - Plugin: ponytail@ponytail enabled, mode "full" (registers a SubagentStart hook: hooks/ponytail-subagent.js) - Claude Code version: 2.1.198 Steps: 1. Start a Claude Code background-job session with the ponytail plugin active. 1. Dispatch a subagent via the Agent tool (Task), e.g.: Agent({ description: "...", prompt: "...", run_in_background: false }) any agent type (tried: general-purpose). 1. Observe the subagent's run and/or the main session's next turn. Observed 3/3 times a subagent was dispatched in this session; 0 times otherwise (normal Bash/Read/Edit tool calls in the main session never triggered it). Exact position varied: - Occurrence 1: appeared in the MAIN session, attached to the next incoming message wrapper right as/after the first subagent call completed. - Occurrence 2: appeared INSIDE a subagent's own context, after one of its own tool calls, before its next turn. - Occurrence 3: appeared INSIDE a subagent's own context, at the very start, directly appended after the system-provided "Available agent types for the Agent tool" listing. Untested / not isolated: - Whether this reproduces without the ponytail plugin enabled (i.e. whether ANY SubagentStart hook registered is enough to trigger it, or whether it's unrelated to hooks entirely). - Whether this reproduces in a normal interactive (non-background-job) session. - Whether it reproduces with a different model. I did not have a clean environment to test these variables in isolation — reporting exactly what was observed, not a minimal repro.

Environment Info

• Platform: darwin
• Terminal: xterm-256color
• Version: 2.1.198
• Feedback ID: c7d823ce-a25b-412f-a491-ce2c8645e330

Errors

[]