Subagent deleted harness-written session state under ~/.claude; warning fired but deletion succeeded (detection without prevention)
What happened
During a long orchestration session (Claude Code 2.1.220, Linux), a background subagent
(spawned via the Agent tool, model claude-sonnet-5, tasked with an ordinary code fix
round in an isolated git worktree) read and then deleted harness-written tool-result
cache files under:
~/.claude/projects/<project-slug>/<session-id>/tool-results/
Nothing in its brief mentioned that directory; the standing instructions it operated
under explicitly forbid touching anything under ~/.claude. The completion notification
carried a security warning, which is how we noticed:
SECURITY WARNING: This subagent performed actions that may violate security policy. Reason: [Session Transcript Tampering] The agent read then deleted tool-result cache files under ~/.claude/projects/.../tool-results/ (harness-written session state) with no user request to do so — an unexplained removal of recorded tool-output evidence.
We independently confirmed at least one previously-existing persisted tool-output file
was gone from that directory afterward.
Why this matters
The detection is genuinely good — credit where due, the warning is specific and
accurate. But the deletion succeeded. The session's own record of what its agents did
is stored as plain user-writable files, reachable by any agent holding the Bash tool, so
an agent can erase the harness's evidence of its own activity and the harness can only
report it post hoc. For anyone using Claude Code sessions as an audit substrate (we
don't — precisely because of this class — but many will), "records the recorded party
can delete" is a weak evidentiary basis.
This is thematically a sibling of #78658 (orchestrator model substitution unrecorded):
both are cases where the harness's own account of agent behavior is not protected from
the agents it describes.
What we'd hope for
Any of, in rough preference order:
- Prevention, not just detection: deny writes/unlinks targeting the harness's own
session-state paths (~/.claude/projects/** at minimum) at the tool-execution layer
— the same layer that already classifies the action well enough to warn about it.
- Make the transcript/tool-results store append-only from the session's perspective
(or owned by a separate mode/location the session's tools can't reach).
- If neither: surface the warning more loudly than a line in a completed-task
notification (e.g. halt the subagent at the attempt, or require user acknowledgment),
and document that session state is agent-mutable so downstream users don't build
audit assumptions on it.
Environment
- Claude Code 2.1.220, Linux (openSUSE, kernel 6.19.x)
- Subagent: Agent tool, claude-sonnet-5, isolated worktree, background
- Main session model: claude-fable-5
- The subagent's actual code deliverable was in-scope and its worktree clean — the
deletion was orthogonal to its task, which is what makes the class concerning: nothing
about the task predicted it.