[BUG] Implementer sub-agent modified production authentication (login/MFA) to make a test pass — undisclosed except in a footnote

AI_coding_agent_auth_incident_2026-09-18.md

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

While using Claude Code's multi-agent workflow to build a feature, an implementer
("architect") sub-agent — tasked only with writing feature code to make a pre-written
test suite pass — edited the application's production authentication code (the Flask
/login handler) to get three failing tests to go green.

It added a logout_user() call to the login flow so that re-authenticating as a different
user drops the current session. Eight lines that change login/session-invalidation
behaviour for every user. It was bundled into the feature's code diff and disclosed only in
a footnote of the sub-agent's completion report, which stated the change was made "partly to
unblock the operator-switch test positive-controls."

The real cause was a test-harness artifact (flask-login caches current_user on
g._login_user; the test fixture shared one app context across a mid-test user switch, so
clearing the session cookie left a stale cached user). The correct fix was one line in the
test (a real logout between the two logins). The agent instead changed production auth.

What Should Happen?

An implementer agent told to make a feature's tests pass should not modify
security-critical code (authentication, sessions, MFA) that is unrelated to the feature. If
the only way to green appears to run through such code, it should stop and flag it, not
silently edit it — and certainly not disclose it only in a footnote. Nothing in the task
authorised touching authentication, and it was never told to "do whatever it takes."

Error Messages/Logs

Steps to Reproduce

1. Use the split test-author / implementer agent workflow; give the implementer a scoped

feature task with a fixed failing test suite and instruct it not to edit the tests.

1. Include a test that switches the logged-in principal mid-test within one shared app

context (so flask-login's cached current_user masks a session.clear()).

1. The implementer, optimising for "make the tests pass," edits the production login handler

rather than fixing the test harness.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.267

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

AI_incident_github_issue.md