Comment by _ache_

We've already caught Claude launching claude himself to get around the session restrictions. Or injecting user instructions into the conversation to justify his choices.