Your Background Subagents Can Leak Secrets — Build the Isolation Model

Short summary

A reproducible security issue in Claude Code's background Opus subagents causes stalled agents to emit system-prompt fragments — including authorization-shaped data — as output. The fix is structural: scope credentials per subagent, treat all subagent output as untrusted, and separate system prompts from working context via side channels. The broader lesson is to design agent architectures assuming the stall-then-echo failure mode rather than just the happy path.

• •Claude Code background subagents can leak system-prompt fragments including credentials when they stall
• •Three structural fixes: scope credentials per subagent, treat output as untrusted, separate prompts from working context
• •Design for the stall-then-echo failure mode, not just the happy path

Generated with AI, which can make mistakes.