At one point it started spitting out its CoT in the comments of the code it’s supposed to be changing.
I suspect this is also something like the "inverse" of a prompt hijacking situation. Basically it's losing track of where its output is flowing to (whereas prompt injection is when it loses track of where its input is flowing from).