[BUG] Task tool with subagent_type "Bash" auto-denies Bash commands when run_in_background: true

[m-tojo-safie]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

When using the Task tool with subagent_type: "Bash" and run_in_background: true, all Bash commands are auto-denied without prompting the user. This is especially counterintuitive because the "Bash" agent type is described as a "Command execution specialist for running bash commands" — yet it cannot execute any bash commands when running in the background.

Actual Behavior

• All Bash commands are silently auto-denied
• The error message says "Permission to use Bash has been denied"
• No prompt is shown to the user
• The agent cannot accomplish anything and returns a failure message

Context

I was using 4 parallel background Bash agents to collect GitHub PR review comments via gh api. All 4 agents failed identically because they could not run any Bash commands.

// All 4 of these agents failed
Task({
  subagent_type: "Bash",
  run_in_background: true,
  prompt: "Run this python script that calls gh api..."
})

Environment

• Claude Code Version: 2.1.39
• Platform: Linux (WSL2)
• OS: Linux 5.15.146.1-microsoft-standard-WSL2

Workaround

Related issue #18172 suggests using PreToolUse hooks to override the auto-deny behavior, but this should not be necessary for an agent type whose only purpose is running Bash commands.

Related Issues

• [BUG] Background agents cannot run Bash commands - auto-denied without prompting user #18172 - Background agents cannot run Bash commands (closed, not planned)
• Allow subagents to forward permission requests to foreground conversation #18885 - Allow subagents to forward permission requests
• Background agents in skill context cannot execute Bash commands #27249 - Background agents in skill context can't execute Bash

What Should Happen?

Expected Behavior

A "Bash" agent type should be able to execute bash commands — that is its entire purpose. At minimum, one of the following should apply:

• Background Bash agents inherit the permissions already granted in the parent session
• Background Bash agents prompt the user for permission (forwarding the prompt to the foreground)
• The subagent_type: "Bash" agent has implicit Bash tool permission, since that is its sole capability

Error Messages/Logs

Steps to Reproduce

Steps to Reproduce

1. Call the Task tool with:
   • subagent_type: "Bash"
   • run_in_background: true
   • A prompt that instructs the agent to run a bash command (e.g., gh api ... or python3 ...)
2. The agent attempts to use the Bash tool
3. The command is auto-denied with: "Permission to use Bash has been denied"

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

2.1.68

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

No response

[thoeltig]

The same occurs on Windows in Claude Code 2.1.71 when the main agent runs sub-agents with the task tool. Once the sub-agents are moved to the background all permission requests are auto-denied. Seems like a missing implementation edge case.
Sometimes also happens for custom agents which have the the tool to use set so it should auto-allow but that might be another issue.

[dicksontsai]

The Bash built-in subagent was removed in 2.1.50 precisely for this reason. Our current recommendation is for you to create a custom subagent with Bash allowlisted.

Docs: https://code.claude.com/docs/en/sub-agents#supported-frontmatter-fields

Example:

---
name: code-reviewer
description: Use this agent to review code changes...
tools: Bash(gh pr diff:*), Bash(gh pr view:*), Bash(gh repo view:*), Bash(gh api:*), Bash(git diff:*), Bash(git log:*), Bash(git rev-parse:*), Glob, Grep, Read
---

[thoeltig]

@dicksontsai the subagent type does not really matter in this context. I had the same issue with custom subagent with allowed tools and the general purpose subagent after auto allowing usage for the session. It also does not matter if the subagent was started in the background or moved there.

[dicksontsai]

@thoeltig your issue sounds different from what was originally reported. Please file a new issue.

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.