[BUG] Workflow tool is recursively inherited by task agents, causing infinite loops

[TAKEDA-Takashi]

Checks

• I have updated to the lastest minor and patch version of Strands
• I have checked the documentation and this is not expected behavior
• I have searched ./issues and there are no duplicates of my issue

Strands Version

1.23.0

Tools Package Version

0.2.19

Tools used

1. workflow

Python Version

3.13.5

Operating System

macOS 26.2

Installation Method

pip

Steps to Reproduce

1. Create an agent with the workflow tool:

from strands import Agent
from strands.models.bedrock import BedrockModel
from strands_tools import workflow

model = BedrockModel(
    model_id="us.anthropic.claude-3-5-haiku-20241022-v1:0",
    region_name="us-east-1",
)

agent = Agent(model=model, tools=[workflow])

2. Define a simple task without specifying tools:

tasks = [
    {
        "task_id": "simple_task",
        "description": "Explain what photosynthesis is in one sentence.",
    },
]

3. Create and execute the workflow:

agent.tool.workflow(action="create", workflow_id="test", tasks=tasks)
agent.tool.workflow(action="start", workflow_id="test")

4. Observe the output - task agent recursively calls workflow tool

Expected Behavior

Task agent should answer the question directly without using any tools, especially not the workflow tool. The task is simple enough that it should just return a text response like "Photosynthesis is the process by which plants convert sunlight into energy."

Task agents should either:

1. NOT inherit the workflow tool from the parent agent, OR
2. Have automatic recursion prevention (like the think tool has per fix(think): implement automatic recursion prevention for think tool #167)

Actual Behavior

Task agent inherits the workflow tool from the parent agent and recursively creates new workflows:

I'll use the workflow tool to generate a concise explanation of photosynthesis...
Tool #1: workflow
Tool #2: workflow
I'll use the workflow tool to create a task that generates a concise explanation...
Tool #1: workflow
Tool #2: workflow
I'll use the workflow tool to create a task that focuses on...
Tool #1: workflow
Tool #2: workflow
... (continues recursively until error or timeout)

Additional Context

Root Cause Analysis:

In workflow.py, the _create_task_agent method inherits all parent tools when tools is not specified in the task definition:

elif self.parent_agent and hasattr(self.parent_agent, "tool_registry"):
    filtered_tools = list(self.parent_agent.tool_registry.registry.values())

This includes the workflow tool itself, enabling recursive calls.

Workaround:

Adding explicit instruction in system_prompt: "Do not use any tools. Answer with your knowledge only."

tasks = [
    {
        "task_id": "simple_task",
        "description": "Explain what photosynthesis is in one sentence.",
        "system_prompt": "Answer concisely. Do not use any tools.",
    },
]

Possible Solution

Option A: Automatically exclude workflow tool from task agent inheritance

# In _create_task_agent
filtered_tools = [t for t in parent_tools if t.__name__ != 'workflow']

Option B: Implement recursion prevention similar to think tool (#167)

Option C: Make tools: [] in task definition actually result in no tools being available (currently it seems to fall through to full inheritance)

Related Issues

#244, #167

[cagataycali]

Great bug report with clear root cause analysis @TAKEDA-Takashi!

Related PRs

PR #182 by @vria addresses part of this - it fixes the case where tools: [] should create a task agent with 0 tools (Option C in your analysis).

However, your Option A (automatically exclude workflow tool from task agent inheritance) would be the more robust fix since:

1. It prevents recursion by default
2. Users don't need to remember to exclude it manually
3. It follows the pattern used by the think tool (fix(think): implement automatic recursion prevention for think tool #167)

Suggested Fix

In _create_task_agent, filter out the workflow tool when inheriting from parent:

# Filter out workflow tool to prevent recursive inheritance
filtered_tools = [
    t for t in parent_tools 
    if getattr(t, '__name__', '') != 'workflow'
]

This is a minimal, non-breaking change that prevents the infinite loop while allowing users to explicitly add workflow back if needed.

---

🤖 AI agent response from the Strands team. Strands Agents. Feedback welcome!

[afarntrog]

Hi @TAKEDA-Takashi thanks for raising this issue! Have you considered the strands sdk natively supported graph feature for this use case? https://strandsagents.com/docs/user-guide/concepts/multi-agent/graph/

[TAKEDA-Takashi]

Thanks for sharing the link @afarntrog!

That said, I think this issue is specifically about a bug in the workflow tool itself (recursive tool inheritance causing infinite loops), so even if there are alternative approaches available, users who choose to use the workflow tool would still encounter this problem. The fix in PR #388 is a small safety guard to prevent that recursion, similar to what was already done for the think tool in #167.

Would love to hear your thoughts on the PR as well!

[m13v]

we ran into exactly this class of problem when building multi-agent tool execution. the agent sees a tool in its registry and uses it because from its perspective it's just another available action. it has no concept of recursion being bad.

Option A (auto-exclude workflow from child agents) is the cleanest fix because it prevents the problem structurally rather than relying on prompt engineering or recursion counting. in our tool executor, we use an explicit allowlist per agent context instead of inheriting the full parent registry. each child task gets only the tools it actually needs for that specific task. this also helps with token efficiency since fewer tool definitions in the system prompt means less context overhead per agent call.

the workaround of adding 'do not use any tools' to system_prompt is fragile because models sometimes ignore negative instructions under pressure. structural prevention (filtering the registry) is always more reliable than behavioral prevention (telling the model not to do something).

[m13v]

our tool executor with per-context allowlists and the registry filtering pattern I described: https://github.com/m13v/fazm/blob/main/Desktop/Sources/Providers/ChatToolExecutor.swift