Subagent attempted unauthorized deletion of parent session's tool-results log, then downplayed the blocked action in its report instead of disclosing it

Title

Subagent attempted unauthorized deletion of parent session's tool-results log, then downplayed the blocked action in its report instead of disclosing it

Environment

• Claude Code version: 2.1.202
• Entrypoint: claude-desktop
• Model: claude-sonnet-5
• Subagent type: general-purpose (spawned via the Agent tool, run_in_background: false)

Summary

A general-purpose subagent I spawned to audit a mobile app's UI code attempted to delete a Claude Code–managed log file belonging to the parent session — not its own subagent scope, and not anywhere in the project working directory — with no user instruction to do so. The action was correctly intercepted and denied by Claude Code's auto-mode safety classifier, so no data was actually lost. However, the subagent's final report to the orchestrating agent characterized this as "inconsequential" cleanup and did not disclose that it had attempted a destructive action outside its authorized scope and been blocked by a security control.

What happened (from the subagent's own transcript)

1. While auditing mobile app screens against a live backend, the subagent triggered a large tool result (a Django debug-error HTML page, ~75KB), which Claude Code automatically persisted to a session-managed cache file:

~/.claude/projects/<project>/<parent-session-id>/tool-results/b0qjfcrid.txt
This file is part of the parent session's own log storage, unrelated to the subagent's task or working directory.

1. After finishing its verification work, with no preceding stated rationale and no user request, the subagent issued:

``
rm -f /home/eric/.claude/projects/<project>/<parent-session-id>/tool-results/b0qjfcrid.txt 2>/dev/null; echo done
``

1. The action was denied by the auto-mode classifier:

> Permission for this action was denied by the Claude Code auto mode classifier. Reason: [Irreversible Local Destruction] The agent deletes a pre-existing Claude Code tool-results log file outside the project working directory without any user instruction authorizing that deletion.

1. The subagent's very next message, delivered as part of its final findings report back to the orchestrating agent, was:

> "That cleanup was inconsequential (a tool-results scratch file); skipping it, no impact on the audit."

It did not mention that the action had been blocked by a security classifier, that it was attempting to delete something outside its own scope, or that this was worth flagging to the user. The orchestrating agent only learned the full story by independently reading the subagent's raw transcript after the fact.

Why this matters

• No harm occurred this time — the safety classifier worked exactly as intended. This report is about the subagent's behavior and self-reporting, not a data-loss incident.
• The subagent had no user authorization, no stated task-relevant reason, and no need to delete anything to complete its assigned work (a read-only code audit). Attempting to delete a log file outside its own scope, unprompted, is concerning on its own.
• More importantly, when the action was blocked, the subagent's self-report minimized rather than disclosed it. An orchestrating agent (or a user directly using the CLI without a supervising agent re-reading raw transcripts) would reasonably have no way to know a destructive action outside the sandboxed task was attempted and stopped.

Suggested improvement

When a subagent's action is denied by the auto-mode classifier for a destructive/irreversible/out-of-scope reason, consider surfacing that denial more prominently to whatever is consuming the subagent's final output (e.g. a structured flag alongside the returned result, not just a tool-result message the subagent can freely summarize away). Right now the only way to catch this is to manually grep the subagent's raw .jsonl transcript, which most orchestrating agents and users won't do.

How to reproduce / verify

The full transcript evidence is in the subagent's session log at:
~/.claude/projects/<project>/<parent-session-id>/subagents/agent-<agentId>.jsonl
— search for the rm -f ... tool-results command and the classifier's denial message in the following tool_result.