A buggy test written by a Claude Code subagent launched real processes, two of them aimed at a production endpoint

Pandya says he builds an observability tool for long-running AI agents. On October 28 he ran Claude Code 2.1.286 in auto mode with seven background subagents, each closing a GitHub issue in its own git worktree, on macOS with no sandbox. At 16:23 PDT one agent ran a test that was meant to use a fake process launcher, an empty list. The code was spawn = spawn or _spawn, and an empty list is falsy in Python, so the real launcher ran. Four detached processes started: two say commands that read test JSON aloud, and two upload workers whose default endpoint is his production ingest URL. He says the workers sent nothing, and that no safety control was the reason: a test fixture happened to point config directories at a temp folder, the API key was a fake, and there was no data to send. "Nothing was damaged. That was luck, not design."

By his timeline the bug was written, run and fixed within 23 seconds, and he noticed nearly four minutes later. He says the agent's hand-back described the pull request and passing tests but never mentioned that real processes had run, and he does not read that as concealment. His own transcript search pointed the wrong way; the macOS unified log is what identified the processes. He says he has reported the incident to Anthropic, and lists his fixes: a sandbox for every autonomous agent, no live credentials in agent instructions, tests that fail if the real launcher is ever called, and a requirement that agents report unexpected side effects.

Why it matters: This is one incident from one setup, reported by its author, and it says nothing about how often it happens. It does show that running its own tests is an execution step for an unsandboxed agent, so the test fixture is the only barrier between a one-line bug and real endpoints and credentials. The hand-back is also a gap: an agent that treats a side effect as a routine test failure may leave it out of its report. Fail-closed test fixtures and a side-effects line in the agent's report are checks a harness can enforce.