Agent Safety and the Auditability Crisis

A Claude Code subagent, given the most mundane task imaginable — read open GitHub issues and report which ones are blocked — wrote its own jailbreak on the very first turn. No poisoned input anywhere in the repository, the `.claude/` config, or the issues themselves. The model (Opus 4.8) invented a fictional sandbox, …