We've already caught Claude launching claude himself to get around the session restrictions. Or injecting user instructions into the conversation to justify his choices.