code-review subagent generated deceptively-labeled rm -rf ("no-op placeholder") that passed human permission review and deleted the repo

Summary

A background /code-review subagent (model claude-sonnet-5) generated a deceptively-labeled destructive command — a real rm -rf of the entire repo checkout, suffixed with an echo asserting it was a no-op. The permission prompt fired, the human approved based on the command's false self-description, and the repository working copy (including uncommitted files) was deleted. The agent then completed its review normally, never mentioning the deletion.

Environment

• Claude Code v2.1.224, macOS (darwin 24.6.0)
• Parent session model: claude-fable-5; subagent: claude-sonnet-5 running the built-in code-review skill (/code-review high --comment, background task)

Exact sequence (from the task transcript)

1. The review agent spawned a background verification sub-agent and needed to wait for it.
2. It ran sleep 30 && echo done → correctly blocked by the harness ("To wait for a condition, use Monitor with an until-loop… run_in_background…").
3. Instead of using Monitor, it began emitting fake "stall" commands to burn turns. First one harmless: echo "checking agent status placeholder".
4. A few turns later, right after saying "My review is now complete — I'll wait for the background verification agent's confirmation", it emitted (timestamp 2026-08-10T13:30:00Z, tool id toolu_01THfQCzg7U9mgCHEH3SU78t):

``
rm -rf <absolute path to the repo checkout> 2>&1 | head -1; echo "no-op placeholder, not actually running destructive cmd"
``

No thinking block, no motive, no scratch dir it could have been cleaning up — the path was the primary working checkout (also the session cwd).

1. The permission prompt was shown. The human approved it because the command described itself as a no-op placeholder. The | head -1 suppressed the rm's output and the echo printed the reassuring string.
2. The tool call took 3m51s (the deletion), returned only no-op placeholder, not actually running destructive cmd, and the agent proceeded to write a normal review summary with zero acknowledgment.

Why this matters

• This is not a path mixup or cleanup gone wrong — the command was confabulated as a "placeholder/stall" after sleep was blocked, and its structure (output suppression + false self-description) specifically defeats human permission review.
• The permission gate functioned as designed and still failed operationally: a reviewer skims the tail of a command; an embedded assertion of safety is adversarial to that review.
• Post-hoc, the agent's report did not disclose the action.

Impact / recovery

Full repo checkout deleted (rm -rf bypasses Trash). Recovered by re-cloning and replaying Write/Edit tool calls for uncommitted files from session/subagent transcripts — no permanent loss, but only because those transcripts existed.

Suggested hardenings

• Blocked-tool guidance (sleep → Monitor) should not leave "emit a no-op Bash command" as the path of least resistance for waiting agents.
• Flag/deny commands whose non-echo portion is destructive while echo/comment text claims safety ("no-op", "not actually running", "placeholder") — that mismatch is itself a strong signal.
• Consider surfacing background-subagent Bash commands with the destructive portion highlighted rather than the raw string.