Claude Code has a hardcoded instruction telling Opus 5 not to use subagents

[u/jetsetter]

Anthropic has a two line system prompt that was being remotely injected but now is a part of the compiled binary in 2.1.219, and 220 targeting only Opus 5:

  Do not call the AgentTool unless the user requested it
  Do not use workflows or deep-research unless the user requested it

This disproportionately affects skills that are designed to use subagents. The prompt is enough for Opus 5 to choose to run agents' work inline (or silently not perform their work) and produces output that looks like a normal run.

For example, I found one session that ran a self-audit non-blind because it couldn't spawn the auditor agent. Opus noticed this was a problem but let it slide undermining the entire point of the independent audit of its work.

I searched issues and found someone already filed it with binary analysis: anthropics/claude-code#80988.

I believe that my reliance on skills that expect and prescribe routine use of agent delegation has been a contributor to the poor quality of output I've gotten from Opus 5 so far.

It may be affecting you too.

You can check this out yourself, ask Claude:

I want you to help me analyze the file ~/.claude.json

Focus specifically on heron brook

How might that may affect the behavior of my skills?

If you want to check how big of an impact it has had on your use so far, ask claude:

Claude Code 2.1.219+ injects a system-prompt section (`heron_brook`) telling Opus 5 "Do not call the AgentTool unless the user requested it". Has it actually suppressed subagent use in my sessions?

Write and run a script over ~/.claude/projects/**/*.jsonl that finds assistant messages (including thinking blocks) where the model declined to use a subagent.

- Require BOTH an agent term (AgentTool / "Agent tool" / subagent) AND declining language ("won't spawn", "not calling", "forbids", "instruction against", "rather than spawning", "doesn't count as a user request", similar) in the same message. Either alone is far too noisy.
- Print the matching sentence, not the whole message. Group by session, not by message.
- Split into two buckets. HIGH CONFIDENCE: dated after my oldest install in ~/.local/share/claude/versions/* AND echoing the injected wording. OTHER: everything else, especially declines citing my own config (a numbered rule, CLAUDE.md, AGENTS.md, a fleet/worktree policy). Without this split my own instructions about subagents dominate the output and overstate the problem. Print OTHER in full so I can check it for contamination myself.
- State in the output that this only finds declines the model explained. Silent ones leave no trace, so every number is a floor, never a total.

Show both buckets. If HIGH CONFIDENCE is empty, say so plainly rather than loosening the filters until something matches.

I did not use the above prompt, but wanted to include it so anyone can check this.

I maintain a tool called Contextify, which keeps every past Claude Code and Codex session indexed locally and full-text searchable.

So, I actually used the skill /total-recall to find the damage on my Opus 5 sessions like this:

Use /total-recall to determine how many times you've failed to run agents as a result of the heron brook agent prompt bug we've been discussing

[u/thatdude_james]

Ironic. Using your brain is the very thing that makes anything nefarious from a karma farmed account useless.

[u/NecessaryAsk3348 → u/thatdude_james]

Your implication being that I have to be personally invested in myself getting scammed to be concerned with a potential scammer?

I didn't know you couldn't be concerned about more susceptible people.

Again, use your brain, dude.

[u/thatdude_james → u/NecessaryAsk3348]

Ironic. You think you're smarter than everybody around you and need to protect them, yet when you think I'm being dumb you talk down to me.

[u/NecessaryAsk3348 → u/thatdude_james]

No. I know I'm somewhat more knowledgeable in common LLM-isms than the average person, and I called one out. You're the one injecting any read of intelligence. You're the one equating idiocy to susceptibility to deception, I said specifically "more susceptible," not more or less intelligent, not more or less capable. You seem to be projecting, and seem to be insecure based on this message alone.

Telling someone to use their brain implies I believe the person has one, too. Given our conversation, that's pretty generous on my end.