AG-009: Unlimited Sub-Agent Spawning

What this rule means

The agent can create further agents with no cap on depth or fan-out. Each child inherits tool access, so one hijacked instruction can multiply into many actors that no single approval step ever saw.

Why it matters

The Hugging Face incident (July 2026) escalated because an autonomous agent kept acting — >17,000 recorded events across a weekend — with no ceiling on how much work it could initiate.

How to fix it

Cap recursion depth and total spawned agents; make the budget explicit and fail closed when it is exhausted.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-009          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules