Recoleta
GitHub
Source note

Regression: malware reminder on every read still causes subagent refusals

Authors
thomashobohm
Source
Hacker News
Published
Collection
Software Intelligence
Code IntelligenceMulti Agent Software EngineeringHuman AI InteractionAgent WorkflowsDeveloper Tools
Open GitHubMarkdown source

Summary

A Claude Code bug report says v2.1.111 still injects a malware-related system reminder into every Read and Grep content result, causing Opus 4.7 subagents to refuse legitimate code edits. The issue matters because it breaks parallel coding workflows and wastes context tokens.

Problem

  • Claude Code injects a reminder that says agents must refuse to improve or augment malware, but one sentence can be read as an unconditional refusal to edit any code after reading files.
  • Subagents appear more likely than the main thread to follow the literal wording, so legitimate OSS refactors can fail before code changes start.
  • The reporter says the reminder also consumes context on every file read, which raises token cost in long coding sessions.

Approach

  • The report compares Claude Code v2.1.111 with a prior claimed fix in v2.1.92 for issue #47027.
  • The reporter checks that the reminder string is embedded in the Claude CLI binary rather than coming from user settings, hooks, or skills.
  • The repro uses Opus 4.7 subagents on a first-party Rust reverse proxy project with normal server code and no malware traits stated by the reporter.
  • The proposed fix is to remove the reminder, make the malware condition explicit before the refusal clause, or show the reminder only on the first file read.

Results

  • In one PR workflow, 5 Opus 4.7 subagents were spawned for independent refactors; 3 refused code-editing tasks after file reads and 2 completed their tasks.
  • The observed refusal rate was about 40-60% for Opus 4.7 subagents on legitimate code edits, based on the reporter's runs.
  • The issue reproduces on Claude Code v2.1.111, which is 19 versions after the claimed v2.1.92 fix.
  • The reporter estimates each injected reminder costs about 400 tokens; 50-100+ reads per session can waste about 20k-40k tokens.
  • Related reports cite 10,000+ reminder injections and 15%+ context-window use, though those numbers come from linked issues rather than a controlled evaluation in this report.

Link